SCA: security update for highcharts (GHSA-35rr-xwfh-x789)

high Tenable Self-Hosted Container Security Plugin ID 477834

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

- Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0,
Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute
names. An attacker who controls chart configuration can provide event-handler keys through
drilldown.breadcrumbs, navigation.breadcrumbs, or hierarchical series breadcrumb options. The keys become
active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates
to a level and hovers over or activates the button. Styled-mode charts do not apply this option and are
not affected. This issue is fixed in 11.4.9, 12.6.1 and 13.1.0. (CVE-2026-118246)

Solution

Update the highcharts library and its related packages to version 11.4.9 or later.

Plugin Details

Severity: High

ID: 477834

Version: Revision 1.1

Type: Local

Family: SCA Checks

Published: 10/29/2026

Updated: 10/29/2026

Risk Information

VPR

Risk Factor: Low

Score: 2.1

Percentile: 8.29

Vendor

Vendor Severity: High

CVSS v2

Risk Factor: Medium

Base Score: 5

Temporal Score: 3.7

Vector: CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N

CVSS Score Source: CVE-2026-118246

CVSS v3

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 5.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: High

Base Score: 8.4

Threat Score: 5.8

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 10/28/2026

Vulnerability Publication Date: 10/28/2026

Reference Information

CVE: CVE-2026-118246

cwe: CWE-79

Detections

Analytics