7.2
HighCVSS 4.0 · from GitHub_M
CVE-2026-118244
Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print
highcharts · Cross-site scripting · CWE-79Affectedhighcharts
FixNo fix listed yet.
PublishedOct 28, 17:36 · GitHub_M
ScoredOct 28 · 7.2 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
It only works under certain conditions, which makes it harder to pull off. CVSS: high attack complexity.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data and change data. CVSS impact.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document. Event handlers in that markup then run in the page origin when printing begins. The issue affects HTML-rendered titles, labels, data labels, responsive text, and the Stock, Maps, and Gantt products shipped in the same package. This issue is fixed in 12.6.1 and 13.1.0.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inhighcharts>= 12.0.0, < 12.6.1–highcharts>= 13.0.0, < 13.1.0–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known