SB2026092947 - Multiple vulnerabilities in highcharts

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026092947

SB2026092947 - Multiple vulnerabilities in highcharts

Published: September 29, 2026 Updated: September 30, 2026

Security Bulletin ID SB2026092947
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Denial of service

Breakdown by Severity

Medium 25% Low 75%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script.

The vulnerability exists due to improper neutralization of javascript: URLs in the markup filter for xlink:href attributes when processing markup in text options. A remote user can supply chart configuration containing an SVG anchor with a javascript: xlink:href URL to execute arbitrary script.

Exploitation requires the chart output to be serialized and parsed again and a user to activate the link.


2) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 2.1 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary code.

The vulnerability exists due to improper neutralization of input in the HTML text parser when re-rendering a chart from a beforeprint handler in Chromium while printing. A remote user can provide crafted markup in chart configuration to execute arbitrary code.

This affects HTML-rendered text options, including useHTML titles, axis labels, data labels, and text set by responsive rules.


3) Cross-site scripting (CVE-ID: N/A)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote user to execute arbitrary script in the origin of the page hosting the chart.

The vulnerability exists due to improper neutralization of event-handler attribute names in the breadcrumbs.style option when processing attacker-controlled chart configuration. A remote user can supply event-handler keys under breadcrumbs.style to execute arbitrary script in the origin of the page hosting the chart.

Exploitation requires breadcrumbs to render and a user to hover over or activate a breadcrumb button; charts rendered in styled mode are not affected.


4) Prototype pollution (CVE-ID: N/A)

CWE-ID: CWE-1321 - Improperly Controlled Modification of Object Prototype Attributes (\'Prototype Pollution\')

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to modify object prototype properties and cause a denial of service.

The vulnerability exists due to improperly controlled modification of object prototype attributes in series column construction when building series columns from attacker-controlled point objects. A remote user can supply crafted point objects containing __proto__ or constructor keys to modify object prototype properties and cause a denial of service.

Injected integer-keyed properties persist after the chart has been built.


Remediation

Install update from vendor's website.

References