Detections
Analytics

SCA: security update for highcharts (GHSA-5793-x2q3-c3q7)

high Tenable Self-Hosted Container Security Plugin ID 477814

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - Highcharts JS is a JavaScript charting library based on SVG. Prior to 11.4.9, 12.6.1, and 13.1.0,
 Highcharts assigns credits.href to the window location when the credits label is clicked without checking
 the URL against the allowed-scheme list. An attacker who controls chart configuration can provide a
 javascript URL and run script in the origin of the hosting page when a user clicks the credits label.
 Highcharts Stock, Maps, and Gantt are included because they ship from the same package. This issue is
 fixed in 11.4.9, 12.6.1 and 13.1.0. (CVE-2026-118251)

Solution

Update the highcharts library and its related packages to version 11.4.9 or later.

See Also

https://github.com/advisories/GHSA-5793-x2q3-c3q7

Plugin Details

Severity: High

ID: 477814

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/29/2026

Updated: 10/29/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.3

Percentile: 10.33

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 4.3

Temporal Score: 3.2

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-118251

CVSS v3

Risk Factor: Medium

Base Score: 6.1

Temporal Score: 5.3

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.4

Threat Score: 5.8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/28/2026

Vulnerability Publication Date: 10/28/2026

Reference Information

CVE: CVE-2026-118251

cwe: CWE-79