CVE-2026-118251

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118251", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.313Z", "datePublished": "2026-10-28T18:02:46.576Z", "dateUpdated": "2026-11-02T20:28:14.493Z"}, "containers": {"cna": {"title": "Highcharts: javascript: URL in credits.href runs script on click", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 8.4, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7"}, {"name": "https://github.com/highcharts/highcharts/pull/25315", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/pull/25315"}, {"name": "https://github.com/highcharts/highcharts/commit/9534773d0f41400aac0945bf8aaebc38dfc72aff", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/commit/9534773d0f41400aac0945bf8aaebc38dfc72aff"}, {"name": "https://github.com/highcharts/highcharts/releases/tag/v13.1.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/releases/tag/v13.1.0"}], "affected": [{"vendor": "highcharts", "product": "highcharts", "versions": [{"version": "< 11.4.9", "status": "affected"}, {"version": ">= 12.0.0, < 12.6.1", "status": "affected"}, {"version": ">= 13.0.0, < 13.1.1", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:02:46.576Z"}, "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0."}], "source": {"advisory": "GHSA-5793-x2q3-c3q7", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-02T20:28:00.504499Z", "id": "CVE-2026-118251", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T20:28:14.493Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118251", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-11-02T20:28:00.504499Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-02T20:28:08.996Z"}}], "cna": {"title": "Highcharts: javascript: URL in credits.href runs script on click", "source": {"advisory": "GHSA-5793-x2q3-c3q7", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.4, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "userInteraction": "ACTIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "highcharts", "product": "highcharts", "versions": [{"status": "affected", "version": "< 11.4.9"}, {"status": "affected", "version": ">= 12.0.0, < 12.6.1"}, {"status": "affected", "version": ">= 13.0.0, < 13.1.1"}]}], "references": [{"url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7", "name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/highcharts/highcharts/pull/25315", "name": "https://github.com/highcharts/highcharts/pull/25315", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/highcharts/highcharts/commit/9534773d0f41400aac0945bf8aaebc38dfc72aff", "name": "https://github.com/highcharts/highcharts/commit/9534773d0f41400aac0945bf8aaebc38dfc72aff", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/highcharts/highcharts/releases/tag/v13.1.0", "name": "https://github.com/highcharts/highcharts/releases/tag/v13.1.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:02:46.576Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118251", "state": "PUBLISHED", "dateUpdated": "2026-11-02T20:28:14.493Z", "dateReserved": "2026-10-27T20:13:55.313Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T18:02:46.576Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "highcharts", "vendor": "highcharts", "versions": [{"status": "affected", "version": "< 11.4.9"}, {"status": "affected", "version": ">= 12.0.0, < 12.6.1"}, {"status": "affected", "version": ">= 13.0.0, < 13.1.1"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0."}], "id": "CVE-2026-118251", "lastModified": "2026-11-02T21:17:26.297", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.4, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118251", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-11-02T20:28:00.504499Z", "version": "2.0.3"}}]}, "published": "2026-10-28T19:17:29.340", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/commit/9534773d0f41400aac0945bf8aaebc38dfc72aff"}, {"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/pull/25315"}, {"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/releases/tag/v13.1.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "highcharts: Highcharts: Cross-site scripting via unvalidated credits link", "id": "2563079", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563079"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.", "A flaw was found in Highcharts. When a user clicks the chart credits label, the library navigates to the configured link without verifying the URL against an allowed-scheme list. An attacker who controls chart configuration settings can supply a malicious link to trigger cross-site scripting (XSS). When interacted with by a user, the malicious script executes within the context of the hosting page, potentially enabling unauthorized actions or data exposure."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-118251", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "rust-toolset:rhel8/rust", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}], "public_date": "2026-10-28T18:02:46Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118251\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118251\nhttps://github.com/highcharts/highcharts/commit/9534773d0f41400aac0945bf8aaebc38dfc72aff\nhttps://github.com/highcharts/highcharts/pull/25315\nhttps://github.com/highcharts/highcharts/releases/tag/v13.1.0\nhttps://github.com/highcharts/highcharts/security/advisories/GHSA-5793-x2q3-c3q7"], "statement": "This vulnerability is rated as Moderate severity because successful exploitation requires an attacker to supply a crafted chart configuration and relies on active user interaction to click the unvalidated credits hyperlink. In typical Red Hat deployments where Highcharts is bundled, charting options are statically defined and do not process untrusted external input. Furthermore, execution is confined to the client-side browser context and does not compromise backend host integrity.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,11.4.9)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.6.1)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[13.0.0,13.1.1)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "highcharts", "source": "cna", "vendor": "highcharts"}, "product": "highcharts", "vendor": "highcharts"}], "created": "2026-10-28T19:15:14.289298+00:00", "updated": "2026-10-28T19:45:07.050294+00:00", "vendors": ["highcharts", "highcharts$PRODUCT$highcharts"]}