Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

Description

The breadcrumbs style option is applied to the breadcrumb button as SVG attributes rather than as CSS, and the attribute names are not filtered. An attacker who controls the chart configuration can supply keys under breadcrumbs.style that name event handlers, and those keys become live handlers on the breadcrumb button, so the attacker’s script runs in the origin of the page hosting the chart.

Recommendation

Update the highcharts package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 13.0.0, <= 13.0.2

  >= 12.0.0, < 12.6.1

  >= 10.0.0, < 11.4.9**

• Patched version(s): **13.1.0

  12.6.1

  11.4.9**

References

• GHSA-35rr-xwfh-x789
• CVE-2026-118246
• CWE-79
• CAPEC-310