Skip to content

highcharts

Follow this package

Get the evidence behind this dependency. Browse imported advisories below, or check an exact version against OSV now. View source coverage.

Behind the package

Explore what the publisher declares for the latest npm release. These details are not a safety score; listed attestations have not been independently verified here.

JavaScript charting framework

Latest release13.1.1

Declared licensehttps://www.highcharts.com/license

Listed maintainerstorsteinhonsi, jtistel, jszuminski, bre1470, cvasseng, oysteinmoseng, khlieng, askelj, goransle, skrulling

Runtime dependencies0

Install-time scriptsNone declared

Integrity metadataRecorded by registry

Attestation metadataNot recorded

Registry deprecationNot marked deprecated

Fetched 31/10/2026, 06:54:27 UTC · Original registry metadata

Release history

Explore up to 40 recent releases. Pick a version for an OSV check; registry metadata alone does not tell you whether a release has known vulnerabilities.

Check the version you ship.

Get a fresh OSV lookup for an exact release. We send the package name and version to OSV without storing a report.

Advisories & recorded fixes

high8.4

CVE-2026-118251Fix available

Highcharts: javascript: URL in credits.href runs script on click

npm / highcharts

3 days ago

Affected range	Recorded fix
Earlier releases before 11.4.9Semantic versions	11.4.9

Version evidence: OSV · GHSA-5793-x2q3-c3q7

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "0"
        },
        {
          "fixed": "11.4.9"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Affected range	Recorded fix
From 12.0.0 before 12.6.1Semantic versions	12.6.1

Version evidence: OSV · GHSA-5793-x2q3-c3q7

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "12.0.0"
        },
        {
          "fixed": "12.6.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Affected range	Recorded fix
From 13.0.0 before 13.1.0Semantic versions	13.1.0

Version evidence: OSV · GHSA-5793-x2q3-c3q7

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "13.0.0"
        },
        {
          "fixed": "13.1.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high7.2

CVE-2026-118250Fix available

Highcharts: dotted series.keys paths write to Object.prototype

npm / highcharts

3 days ago

Affected range	Recorded fix
From 12.0.0 before 12.6.1Semantic versions	12.6.1

Version evidence: OSV · GHSA-rmqc-xvr3-v46c

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "12.0.0"
        },
        {
          "fixed": "12.6.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Affected range	Recorded fix
From 13.0.0 before 13.1.0Semantic versions	13.1.0

Version evidence: OSV · GHSA-rmqc-xvr3-v46c

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "13.0.0"
        },
        {
          "fixed": "13.1.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Affected range	Recorded fix
From 6.1.0 before 11.4.9Semantic versions	11.4.9

Version evidence: OSV · GHSA-rmqc-xvr3-v46c

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "6.1.0"
        },
        {
          "fixed": "11.4.9"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high7.2

CVE-2026-118249Fix available

Highcharts: series column construction writes to Object.prototype

npm / highcharts

3 days ago

Affected range	Recorded fix
From 13.0.0 before 13.1.0Semantic versions	13.1.0

Version evidence: OSV · GHSA-gfvx-2c2g-38wq

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "13.0.0"
        },
        {
          "fixed": "13.1.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high8.4

CVE-2026-118246Fix available

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

npm / highcharts

3 days ago

Affected range	Recorded fix
From 10.0.0 before 11.4.9Semantic versions	11.4.9

Version evidence: OSV · GHSA-35rr-xwfh-x789

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "10.0.0"
        },
        {
          "fixed": "11.4.9"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Affected range	Recorded fix
From 12.0.0 before 12.6.1Semantic versions	12.6.1

Version evidence: OSV · GHSA-35rr-xwfh-x789

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "12.0.0"
        },
        {
          "fixed": "12.6.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Affected range	Recorded fix
From 13.0.0 before 13.1.0Semantic versions	13.1.0

Version evidence: OSV · GHSA-35rr-xwfh-x789

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "13.0.0"
        },
        {
          "fixed": "13.1.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high7.2

CVE-2026-118244Fix available

Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing

npm / highcharts

3 days ago

Affected range	Recorded fix
From 12.0.0 before 12.6.1Semantic versions	12.6.1

Version evidence: OSV · GHSA-65hg-cf3f-5m39

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "12.0.0"
        },
        {
          "fixed": "12.6.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Affected range	Recorded fix
From 13.0.0 before 13.1.0Semantic versions	13.1.0

Version evidence: OSV · GHSA-65hg-cf3f-5m39

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "13.0.0"
        },
        {
          "fixed": "13.1.0"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

high7.2

CVE-2026-116796Fix available

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

npm / highcharts

3 days ago

Affected range	Recorded fix
From 10.3.2 before 11.4.9Semantic versions	11.4.9

Version evidence: OSV · GHSA-mw4f-gj5x-6xr4

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "10.3.2"
        },
        {
          "fixed": "11.4.9"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Affected range	Recorded fix
From 12.0.0 before 12.6.2Semantic versions	12.6.2

Version evidence: OSV · GHSA-mw4f-gj5x-6xr4

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "12.0.0"
        },
        {
          "fixed": "12.6.2"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}

Affected range	Recorded fix
From 13.0.0 before 13.1.1Semantic versions	13.1.1

Version evidence: OSV · GHSA-mw4f-gj5x-6xr4

View original version evidence

{
  "ranges": [
    {
      "events": [
        {
          "introduced": "13.0.0"
        },
        {
          "fixed": "13.1.1"
        }
      ],
      "type": "SEMVER"
    }
  ],
  "versions": []
}