CVE-2026-118246
Description
A flaw was found in Highcharts. This vulnerability allows cross-site scripting (XSS) because the library applies breadcrumb styling as unfiltered Scalable Vector Graphics (SVG) attributes rather than style properties. A remote attacker who controls chart configurations can inject malicious event handlers into breadcrumb navigation settings. When a user interacts with the affected breadcrumb button, the script executes within the context of the victim's browser session, potentially enabling unauthorized actions or data exposure.
Statement
This flaw is rated as Moderate severity for Red Hat products because successful exploitation requires multiple preconditions, including injecting malicious properties into chart configurations and eliciting explicit user interaction within the application interface. In environments where Highcharts is embedded within web consoles or reporting dashboards, an attacker must be able to manipulate hierarchical navigation parameters or breadcrumb presentation settings to inject arbitrary script handlers into SVG elements. Because malicious execution occurs entirely within the context of the client's browser session upon hovering or clicking breadcrumb controls, backend server integrity is not directly compromised.
Mitigation
Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 6.1 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | Required | N/A | N/A |
| Scope | Changed | N/A | N/A |
| Confidentiality | Low | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
