The systeminformation Node.js library version 5.33.13 on Linux contains a path traversal vulnerability in its networkStats(iface) function. This function constructs file paths under /sys/class/net/ from user-supplied interface names without validating that the resolved path remains within the expected directory. An attacker able to create symlinks and control the iface parameter can cause the function to read and return the first line of arbitrary files accessible to the Node process, including files with restricted permissions. The vulnerability is fixed in version 5.33.14. The library itself does not expose a network interface, and no remote exploit scenario has been demonstrated.
The systeminformation library version prior to 5.33.13 contains a prototype pollution vulnerability in the networkStats() function. This occurs when the interface name '__proto__' is passed, causing writes to Object.prototype and polluting all objects in the Node.js process. The vulnerability affects applications running on FreeBSD, OpenBSD, or NetBSD that pass untrusted input to networkStats(). The impact includes unexpected properties appearing on all objects, which can alter application logic and enumeration behavior. No remote code execution or attacker-controlled values are known. A fix is available in version 5.33.13.
LangGraph Python SDK v3 streaming client versions 0.4.0 through 0.4.5 improperly handle unencoded thread_id and assistant_id values in request paths, allowing relative path segments to redirect authenticated GET requests to other paths on the same server. This affects also langgraph versions 1.2.3 through 1.2.13 when used with vulnerable SDK versions. The vulnerability allows an attacker controlling these identifiers to cause the SDK to fetch and return data from arbitrary readable paths on the server, but does not allow modification of data. The issue is fixed in langgraph-sdk 0.4.6 and langgraph 1.2.14.
### Impact
The filter applied to markup in text options checks `href`, `src` and a few similar attributes against an allowed-scheme list, but accepts `xlink:href` without that check, so an SVG anchor whose `xlink:href` is a `javascript:` URL passes the filter, whether or not the option is rendered with `useHTML`. In the live page the attribute is written without the XLink namespace, so browsers do not treat the anchor as a link there.
The attribute is preserved verbatim in the chart's serialised output: the SVG produced by the exporting module, including the default SVG download, declares the XLink namespace and contains the anchor, and so does the markup of the chart container. Any document that parses that output again, such as the downloaded SVG opened in a browser or a page that inlines exported or server-rendered chart markup, then holds a working link, and an attacker who controls the chart configuration can thereby run script in the origin of that document when a user activates the link.
Exploitation requires that untrusted data reach a text option such as the title, that the chart be exported or its markup be serialised and parsed again, and that a user activate the link.
### Workarounds
Drop-in fix for all affected versions (10.3.2 - 13.1.0).
Add the below IIFE to run after Highcharts is loaded, before creating a chart.
```
!function(t){var e=t&&t.AST;if(e&&"function"==typeof e.filterUserAttributes&&!e.xlinkHrefPatched){var r=e.filterUserAttributes,n=Object.prototype.hasOwnProperty;e.filterUserAttributes=function(t){return t&&n.call(t,"xlink:href")&&!o(t["xlink:href"])&&delete t["xlink:href"],r.call(this,t)},e.xlinkHrefPatched=!0}function o(t){var r=e.allowedReferences||["https://","http://","mailto:","/","../","./","#"];return"string"==typeof t&&r.some(function(e){return 0===t.indexOf(e)})}}(Highcharts);
```
### Obtaining the patched version
The patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install highcharts@13.1.1`. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example `https://code.highcharts.com/13.1.1/highcharts.js`. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/getting-started/installation).
An authenticated user in Grafana OSS and Enterprise 13.2 with the experimental kubernetesSsoSettingsApi feature enabled can read SSO client secrets and modify instance-wide SSO settings without proper authorization. This vulnerability arises from missing authorization checks. The feature toggle is disabled by default.
Highcharts JS versions from 2.0.0 up to but not including 3.2.0, and versions from 3.2.0 up to but not including 4.0.0, as well as versions before 13.0.0-beta.2, contain a cross-site scripting (XSS) vulnerability. This occurs because the credits.href property is used without validating the URL scheme, allowing an attacker controlling the Grid configuration to inject a javascript: URL. Activating the credits link then executes arbitrary script in the context of the hosting page, potentially exposing application data and session state. The issue is fixed in versions 3.2.0, 4.0.0, and 13.0.0-beta.2.
CVE-2026-118253 is a high severity cross-site scripting (XSS) vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.3. The issue occurs in Highcharts Dashboards edit mode where fullscreen language labels are parsed as HTML instead of text, allowing an attacker controlling language options to inject malicious markup with event handlers. This code executes in the context of the hosting page when the fullscreen control is rendered. The vulnerability is only exploitable when edit mode is enabled and the fullscreen view option is present. The flaw is fixed in versions 4.2.3 and 13.0.0-beta.2.
Highcharts JS versions prior to 11.4.9, 12.6.1, and 13.1.1 contain a cross-site scripting (XSS) vulnerability. The issue arises because the credits.href property is assigned directly to the window location without validating the URL scheme. An attacker controlling the chart configuration can supply a javascript: URL, which executes script in the context of the hosting page when a user clicks the credits label. This vulnerability affects Highcharts and its related packages Highcharts Stock, Maps, and Gantt. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.1.
CVE-2026-118250 is a prototype pollution vulnerability in Highcharts JS, a JavaScript charting library. Versions from 6.1.0 up to but not including 11.4.9, 12.0.0 up to 12.6.1, and 13.0.0 up to 13.1.0 are affected. The flaw allows an attacker controlling series.keys and point data to manipulate the __proto__ property, assigning arbitrary properties to Object.prototype. This affects all JavaScript on the page without requiring user interaction beyond rendering the chart. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.0.
Highcharts JS versions from 13.0.0 up to but not including 13.1.0 are affected by a prototype pollution vulnerability. This flaw allows malicious point option keys such as __proto__ and constructor to modify Object.prototype or the Object constructor during chart rendering. Such modifications can disrupt page rendering or alter application behavior without user interaction beyond rendering the chart. The issue is resolved in version 13.1.0.
CVE-2026-118248 is a prototype pollution vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.2. The issue arises in Highcharts Dashboards edit mode where the editableOptions propertyPath segments do not reject prototype-related keys such as __proto__ or constructor. An attacker controlling editableOptions can exploit this to write values onto Object.prototype, affecting JavaScript behavior throughout the page. This vulnerability is fixed in versions 4.2.2 and 13.1.0.
CVE-2026-118247 is a prototype pollution vulnerability in Highcharts JS affecting versions prior to 13.1.0, Dashboards prior to 4.2.3, and Grid Pro prior to 3.2.0. The issue arises because DataTable single-cell writers use untrusted column IDs without filtering out __proto__ or constructor keys, allowing writes to Object.prototype or the Object constructor. This can alter application control flow or disrupt rendering. Exploitation requires control over table or component column IDs and cell or API writes. The vulnerability is fixed in Highcharts 13.1.0, Dashboards 4.2.3, and Grid Pro 3.2.0.
Highcharts JS versions from 10.0.0 up to but not including 11.4.9, 12.0.0 up to but not including 12.6.1, and 13.0.0 up to but not including 13.1.1 are vulnerable to a cross-site scripting (XSS) issue. The vulnerability arises because Highcharts applies breadcrumbs.style as SVG attributes without filtering attribute names, allowing attackers controlling chart configuration to inject event-handler keys. This leads to execution of malicious scripts in the context of the hosting page when users interact with breadcrumb buttons. Styled-mode charts are not affected. The issue is fixed in versions 11.4.9, 12.6.1, and 13.1.1.
Highcharts JS versions from 1.0.0 up to but not including 4.2.3 contain a cross-site scripting (XSS) vulnerability in the Highcharts Dashboards feature. The issue arises because the dashboard uses an unchecked property lookup to invoke chart constructors, allowing an attacker controlling dashboard configuration to execute arbitrary markup and event handlers in the hosting page without user interaction. This vulnerability is fixed in versions 4.2.3 and 13.1.0.
Highcharts JS versions from 12.0.0 up to but not including 12.6.1, and from 13.0.0 up to but not including 13.1.0, are affected by a cross-site scripting (XSS) vulnerability. This occurs because Highcharts falls back to assigning raw markup to innerHTML when DOMParser fails, before applying its allow-list. In Chromium browsers, this can lead to execution of untrusted HTML event handlers during the beforeprint event when charts are redrawn. The vulnerability affects HTML-rendered titles, labels, data labels, responsive text, and related Highcharts products. The issue is fixed in versions 12.6.1 and 13.1.0.