CVE-2026-116796

A flaw was found in Highcharts. An attacker who can supply chart text configurations can execute arbitrary script in a victim's browser session. The library fails to validate URL schemes on certain Scalable Vector Graphics (SVG) anchor link attributes, allowing malicious JavaScript links to persist into exported chart output. When a user opens the exported chart and clicks the link, the injected script runs within the context of the user's browser origin.

This vulnerability is rated as having Moderate impact for Red Hat environments because successful exploitation requires multiple preconditions, including user interaction and non-default application processing workflows. An attacker cannot execute code directly across the network; instead, malicious input must be accepted into chart configuration fields, rendered or exported as an SVG graphic, and subsequently parsed and clicked by a victim. Consequently, the flaw cannot be triggered automatically without direct victim engagement, limiting the immediate risk and preventing broader system compromise or service disruption.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.