Description
When the HTML text parser cannot obtain a document from DOMParser because the call throws, it falls back to assigning the raw markup to the innerHTML of an element created in the hosting document, and the allow-list is applied only to the resulting DOM afterwards.
Recommendation
Update the highcharts package to the latest compatible version. Followings are version details:
Affected version(s): **>= 13.0.0, <= 13.0.2 >= 12.0.0, < 12.6.1** Patched version(s): **13.1.0 12.6.1**
References
Could your website be exposed too?
SmartScanner can check your website for Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing and gives you actionable findings to investigate.
Start a free scanRelated Issues
- @platejs/core HTML deserialization can trigger browser behavior during parsing - CVE-2026-88976
- Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts - CVE-2026-116796
- Highcharts Grid parses pagination language options as HTML - @highcharts/grid-lite - CVE-2026-118254
- @nuxtjs/mdc's URL sanitizer misses SVG xlink:href and data:text/html, allowing XSS from untrusted markdown at the defaul - CVE-2026-63671
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026