highcharts
npm7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting highchartspage 1 of 1
- CVE-2018-20801HIGHCVSS 7.5EG 7.5fixed in 6.1.02019-03-14
In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the SVGRenderer component, aka ReDoS.
- CVE-2021-29489HIGHCVSS 7.6EG 7.6fixed in 9.0.02021-05-05
Highcharts JS is a JavaScript charting library based on SVG. In Highcharts versions 8 and earlier, the chart options structure was not systematically filtered for XSS vectors. The potential impact was that content from untrusted sources co…
- CVE-2026-116796HIGHCVSS 7.2EG 7.2fixed in 11.4.9, 12.6.2 or 13.1.1, by version range2026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 10.3.2 until 11.4.9, 12.6.2, and 13.1.1, Highcharts accepts an SVG anchor xlink:href attribute without applying the allowed-scheme check used for href and src. An attacker w…
- CVE-2026-118244HIGHCVSS 7.2EG 7.2fixed in 12.6.1 or 13.1.0, by version range2026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 12.0.0 until 12.6.1 and 13.1.0, Highcharts falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chro…
- CVE-2026-118246HIGHCVSS 8.4EG 8.4fixed in 11.4.9, 12.6.1 or 13.1.0, by version range2026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who cont…
- CVE-2026-118249HIGHCVSS 7.2EG 7.2fixed in 13.1.02026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point…
- CVE-2026-118251HIGHCVSS 8.4EG 8.4fixed in 11.4.9, 12.6.1 or 13.1.0, by version range2026-10-28
Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme …
Check whether highcharts is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for highcharts CVEs against the assets you own.
Book a Demo →