CVE-2026-118244

A flaw was found in Highcharts. An attacker can execute arbitrary script via cross-site scripting (XSS) by supplying malicious HTML markup in chart text options, such as titles or labels. When a chart is redrawn during a print event in certain browsers, an error causes Highcharts to bypass its sanitization allowlist and assign raw markup directly to the document. Consequently, embedded event handlers run in the victim's browser within the context of the hosting page, potentially leading to unauthorized actions or data disclosure.

This vulnerability is rated as having Moderate impact because exploitation requires user interaction to initiate a print operation alongside an application workflow that re-renders chart components using untrusted user input. Red Hat products that bundle this charting library do not expose vulnerable chart options by default, and execution is confined to the client browser origin without directly affecting backend infrastructure. Consequently, the blast radius is restricted to client-side script execution within the context of the user session.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.