Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

影響: npm:highcharts >= 10.0.0, < 11.4.9 → 11.4.9, npm:highcharts >= 12.0.0, < 12.6.1 → 12.6.1, npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0

The breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live handlers on the breadcrumb button, so the attacker's script runs in the origin of the page hosting the chart. The option is reached through drilldown.breadcrumbs, navigation.breadcrumbs and the breadcrumbs option…

在 GitHub Advisory Database 阅读

2026/10/29 04:56，GitHub Advisory Database 发布了“Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-118246。