{"id":"ghsa-ghsa-65hg-cf3f-5m39","seq":2056984,"kind":"advisory","title":"Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing","url":"https://github.com/advisories/GHSA-65hg-cf3f-5m39","permalink":"https://vulnpulse.app/items/ghsa-ghsa-65hg-cf3f-5m39","summary":"影響: npm:highcharts >= 12.0.0, < 12.6.1 → 12.6.1, npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0\nWhen the HTML text parser cannot obtain a document from DOMParser because the call throws, it falls back to assigning the raw markup to the innerHTML of an element created in the hosting document, and the allow-list is applied only to the resulting DOM afterwards. In Chromium the Trusted Types policy callback that the parser uses throws while a beforeprint handler is running, so if the hosting page re-renders the chart from a beforeprint handler, every HTML-rendered text option parsed at that m…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-118244"],"tags":["GHSA-65hg-cf3f-5m39","highcharts","highcharts"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:55:22.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}