Highcharts: javascript: URL in credits.href runs script on click
Impact
A credits.href value beginning with javascript: is assigned to the window location when the credits label is clicked, without being checked against an allowed-scheme list. An attacker who controls the chart configuration can therefore run script in the origin of the page hosting the chart. Exploitation requires that untrusted data reach the chart configuration and that a user click the credits label. Charts built with Highcharts Stock, Maps and Gantt are included, since those ship from the same package as Core.
Source excerpt · OSVExploitation requires that untrusted data reach the chart configuration and that a user click the credits label.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
| Affected range | Recorded fix |
|---|---|
| Earlier releases before 11.4.9Semantic versions | 11.4.9 |
| From 12.0.0 before 12.6.1Semantic versions | 12.6.1 |
| From 13.0.0 before 13.1.0Semantic versions | 13.1.0 |
Version evidence: OSV · GHSA-5793-x2q3-c3q7
View original version evidence (0 explicit versions)
Affected products
Vendor version evidence. Product records are separate from automatic dependency matching.
highcharts · GitHub_M
highcharts
3 ranges
highcharts · GitHub_M
highcharts
Compare with this publisher’s ranges. This does not inspect your installation.
affected
< 11.4.9
>= 12.0.0, < 12.6.1
>= 13.0.0, < 13.1.1
Other versions: unknown
Original source description
Impact
A credits.href value beginning with javascript: is assigned to the window location when the credits label is clicked, without being checked against an allowed-scheme list. An attacker who controls the chart configuration can therefore run script in the origin of the page hosting the chart. Exploitation requires that untrusted data reach the chart configuration and that a user click the credits label. Charts built with Highcharts Stock, Maps and Gantt are included, since those ship from the same package as Core.
Workarounds
Drop-in fix - for any versions affected (5.0.0-13.0.2). Add the below IIFE to run after Highcharts is loaded, but before a chart is created.
!function(t){if(t&&t.Chart&&!t.Chart.prototype.creditsHrefPatched){var r=t.Chart.prototype,e=r.addCredits;r.addCredits=function(n){var o=t.merge(!0,this.options.credits,n);return o&&o.href&&!c(o.href)&&delete o.href,e.call(this,o)},r.creditsHrefPatched=!0}function c(r){var e=t.AST&&t.AST.allowedReferences||["https://","http://","mailto:","/","../","./","#"];return"string"==typeof r&&e.some(function(t){return 0===r.indexOf(t)})}}(Highcharts);
Obtaining the patched version
The patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example npm install highcharts@ 13.1.0. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example https://code.highcharts.com/13.1.0/highcharts.js. For more on each installation method, see the installation guide.
Inside the record
Evidence available
Describes the evidence in this view, not whether the product is safe.
Original records
CVE-2026-118251View the latest unmodified CVE JSON from the official source. It may be newer than this imported page.
cve.new JSON →Underlying weaknesses
The source’s classification of what caused the vulnerability.
Contributing organizations · 1
Assigning organization
What changed
Follow changesLarge field values are marked as truncated previews. Original source snapshots remain retained.