{"id":"ghsa-ghsa-35rr-xwfh-x789","seq":2056978,"kind":"advisory","title":"Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes","url":"https://github.com/advisories/GHSA-35rr-xwfh-x789","permalink":"https://vulnpulse.app/items/ghsa-ghsa-35rr-xwfh-x789","summary":"影響: npm:highcharts >= 10.0.0, < 11.4.9 → 11.4.9, npm:highcharts >= 12.0.0, < 12.6.1 → 12.6.1, npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0\nThe breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live handlers on the breadcrumb button, so the attacker's script runs in the origin of the page hosting the chart. The option is reached through drilldown.breadcrumbs, navigation.breadcrumbs and the breadcrumbs option…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-118246"],"tags":["GHSA-35rr-xwfh-x789","highcharts","highcharts","highcharts"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:56:07.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}