CVE-2026-118246

A flaw was found in Highcharts. This vulnerability allows cross-site scripting (XSS) because the library applies breadcrumb styling as unfiltered Scalable Vector Graphics (SVG) attributes rather than style properties. A remote attacker who controls chart configurations can inject malicious event handlers into breadcrumb navigation settings. When a user interacts with the affected breadcrumb button, the script executes within the context of the victim's browser session, potentially enabling unauthorized actions or data exposure.

This flaw is rated as Moderate severity for Red Hat products because successful exploitation requires multiple preconditions, including injecting malicious properties into chart configurations and eliciting explicit user interaction within the application interface. In environments where Highcharts is embedded within web consoles or reporting dashboards, an attacker must be able to manipulate hierarchical navigation parameters or breadcrumb presentation settings to inject arbitrary script handlers into SVG elements. Because malicious execution occurs entirely within the context of the client's browser session upon hovering or clicking breadcrumb controls, backend server integrity is not directly compromised.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.