Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

影響: npm:highcharts >= 10.0.0, < 11.4.9 → 11.4.9, npm:highcharts >= 12.0.0, < 12.6.1 → 12.6.1, npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0

The breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live handlers on the breadcrumb button, so the attacker's script runs in the origin of the page hosting the chart. The option is reached through drilldown.breadcrumbs, navigation.breadcrumbs and the breadcrumbs option…

Read on GitHub Advisory Database

On 10/29/2026, 04:56 AM, GitHub Advisory Database published "Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js. CVE: CVE-2026-118246.