Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0, Highcharts assigns credits.href to the window location when the credits label is clicked without checking the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a javascript URL and run script in the origin of the hosting page when a user clicks the credits label. Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0,     Highcharts assigns credits.href to the window location when the credits label is clicked without checking     the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a     javascript URL and run script in the origin of the hosting page when a user clicks the credits label.
    Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is     fixed in 11.4.9, 12.6.1 and 13.1.0. (CVE-2026-118251)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0,
    Highcharts assigns credits.href to the window location when the credits label is clicked without checking
    the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a
    javascript URL and run script in the origin of the hosting page when a user clicks the credits label.
    Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is
    fixed in 11.4.9, 12.6.1 and 13.1.0. (CVE-2026-118251)

ID	Name	Product	Family	Type	Severity
374023	Linux Distros Unpatched Vulnerability : CVE-2026-118251	Nessus	Misc.	Local	high
477814	SCA: security update for highcharts (GHSA-5793-x2q3-c3q7)	Tenable Cloud Security	SCA Checks	Local	high
477814	SCA: security update for highcharts (GHSA-5793-x2q3-c3q7)	Tenable Self-Hosted Container Security	SCA Checks	Local	high

Detections

Analytics

CVE-2026-118251

high

Tenable Plugins

high

high

high