CVE-2026-118251

A flaw was found in Highcharts. When a user clicks the chart credits label, the library navigates to the configured link without verifying the URL against an allowed-scheme list. An attacker who controls chart configuration settings can supply a malicious link to trigger cross-site scripting (XSS). When interacted with by a user, the malicious script executes within the context of the hosting page, potentially enabling unauthorized actions or data exposure.

This vulnerability is rated as Moderate severity because successful exploitation requires an attacker to supply a crafted chart configuration and relies on active user interaction to click the unvalidated credits hyperlink. In typical Red Hat deployments where Highcharts is bundled, charting options are statically defined and do not process untrusted external input. Furthermore, execution is confined to the client-side browser context and does not compromise backend host integrity.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.