### Impact
When the HTML text parser cannot obtain a document from `DOMParser` because the call throws, it falls back to assigning the raw markup to the `innerHTML` of an element created in the hosting document, and the allow-list is applied only to the resulting DOM afterwards. In Chromium the Trusted Types policy callback that the parser uses throws while a `beforeprint` handler is running, so if the hosting page re-renders the chart from a `beforeprint` handler, every HTML-rendered text option parsed at that moment, such as `useHTML` titles, axis labels and data labels or text set by responsive rules, is inserted unsanitized, and event handlers embedded in that markup run in the origin of the page hosting the chart. Exploitation requires that untrusted data reach the chart configuration, that the hosting page update the chart from a `beforeprint` handler in Chromium, and that printing be started, which the print item of the exporting menu does on its own. Charts built with Highcharts Stock, Maps and Gantt are included, since those ship from the same package as Core.
### Workarounds
**Drop-in fix - for any versions affected (12.0.0-13.0.2).**
Add the below IIFE to run after Highcharts is loaded.
```
((n)=>{n.AST.prototype.parseMarkup=function parseMarkup(t){let e,i=[];t=t.trim().replace(/ style=(["'])/g," data-style=$1");try{e=new DOMParser().parseFromString(tI?tI.createHTML(t):t,"text/html")}catch{}if(!e)try{e=new DOMParser().parseFromString(t,"text/html")}catch{}e||((e=n.doc.implementation.createHTMLDocument("")).body.innerHTML=t);let s=(t,e)=>{let i=t.localName||t.nodeName.toLowerCase(),o={tagName:i};"#text"===i&&(o.textContent=t.textContent||"");let r=t.attributes;if(r){let t={};[].forEach.call(r,e=>{"data-style"===e.name?o.style=tB.parseStyle(e.value):t[e.name]=e.value}),o.attributes=t}if(t.childNodes.length){let e=[];[].forEach.call(t.childNodes,t=>{s(t,e)}),e.length&&(o.children=e)}e.push(o)};return[].forEach.call(e.body.childNodes,t=>s(t,i)),i};})(Highcharts);
```
[Live demo & testing](https://jsfiddle.net/BlackLabel/pb6jLf7g/)
### Obtaining the patched version
The patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example npm install highcharts@13.1.0. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example https://code.highcharts.com/13.1.0/highcharts.js. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/getting-started/installation).
Highcharts JS versions from 2.0.0 up to but not including 3.2.0, and versions from 3.2.0 up to but not including 4.0.0, as well as versions before 13.0.0-beta.2, contain a cross-site scripting (XSS) vulnerability. This occurs because the credits.href property is used without validating the URL scheme, allowing an attacker controlling the Grid configuration to inject a javascript: URL. Activating the credits link then executes arbitrary script in the context of the hosting page, potentially exposing application data and session state. The issue is fixed in versions 3.2.0, 4.0.0, and 13.0.0-beta.2.
Highcharts JS versions from 1.0.0 up to but not including 4.2.3 contain a cross-site scripting (XSS) vulnerability in the Dashboards edit-mode sidebar. The issue arises because component language strings are parsed as HTML instead of being inserted as text, allowing an attacker who controls the Dashboards language configuration to inject malicious markup with event handlers. This code executes in the context of the hosting page when the edit-mode sidebar is opened and the affected labels render. The vulnerability is fixed in version 4.2.3.
Highcharts JS versions prior to 11.4.9, 12.6.1, and 13.1.1 contain a cross-site scripting (XSS) vulnerability. The issue arises because the credits.href property is assigned directly to the window location without validating the URL scheme. An attacker controlling the chart configuration can supply a javascript: URL, which executes script in the context of the hosting page when a user clicks the credits label. This vulnerability affects Highcharts and its related packages Highcharts Stock, Maps, and Gantt. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.1.
CVE-2026-118250 is a prototype pollution vulnerability in Highcharts JS, a JavaScript charting library. Versions from 6.1.0 up to but not including 11.4.9, 12.0.0 up to 12.6.1, and 13.0.0 up to 13.1.0 are affected. The flaw allows an attacker controlling series.keys and point data to manipulate the __proto__ property, assigning arbitrary properties to Object.prototype. This affects all JavaScript on the page without requiring user interaction beyond rendering the chart. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.0.
Highcharts JS versions from 13.0.0 up to but not including 13.1.0 are affected by a prototype pollution vulnerability. This flaw allows malicious point option keys such as __proto__ and constructor to modify Object.prototype or the Object constructor during chart rendering. Such modifications can disrupt page rendering or alter application behavior without user interaction beyond rendering the chart. The issue is resolved in version 13.1.0.
CVE-2026-118248 is a prototype pollution vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.2. The issue arises in Highcharts Dashboards edit mode where the editableOptions propertyPath segments do not reject prototype-related keys such as __proto__ or constructor. An attacker controlling editableOptions can exploit this to write values onto Object.prototype, affecting JavaScript behavior throughout the page. This vulnerability is fixed in versions 4.2.2 and 13.1.0.
Highcharts JS versions from 10.0.0 up to but not including 11.4.9, 12.0.0 up to but not including 12.6.1, and 13.0.0 up to but not including 13.1.1 are vulnerable to a cross-site scripting (XSS) issue. The vulnerability arises because Highcharts applies breadcrumbs.style as SVG attributes without filtering attribute names, allowing attackers controlling chart configuration to inject event-handler keys. This leads to execution of malicious scripts in the context of the hosting page when users interact with breadcrumb buttons. Styled-mode charts are not affected. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.1.
CVE-2026-118243 is a prototype pollution vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.2. The issue arises because Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. If an attacker supplies a __proto__ table ID via the dataPool connector configuration, it modifies Object.prototype, creating enumerable properties that affect all objects. This can disrupt features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and enabled component sync, but no user interaction beyond loading the dashboard is needed. The vulnerability is fixed in version 4.2.2.
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column configuration can add event-handler attributes to every rendered row or to the control created when a cell enters edit mode. Script then runs in the hosting page origin when a user hovers over or focuses an input or begins editing. This issue is fixed in Grid Pro 3.2.0.
Highcharts JS versions from 10.3.2 up to but not including 11.4.9, 12.0.0 up to 12.6.2, and 13.0.0 up to 13.1.1 contain a cross-site scripting (XSS) vulnerability. This occurs because the SVG anchor xlink:href attribute does not enforce the allowed-scheme check that is applied to href and src attributes. An attacker controlling chart text options can embed a javascript URL that executes script when the exported or server-rendered SVG is parsed and the link is activated. The issue is fixed in versions 11.4.9, 12.6.2, and 13.1.1.