Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Description

The filter applied to markup in text options checks href, src and a few similar attributes against an allowed-scheme list, but accepts xlink:href without that check, so an SVG anchor whose xlink:href is a javascript: URL passes the filter, whether or not the option is rendered with useHTML.

Recommendation

Update the highcharts package to the latest compatible version. Followings are version details:

• Affected version(s): **>= 13.0.0, <= 13.1.0

  >= 12.0.0, < 12.6.2

  >= 10.3.2, < 11.4.9**

• Patched version(s): **13.1.1

  12.6.2

  11.4.9**

References

• GHSA-mw4f-gj5x-6xr4
• CVE-2026-116796
• CWE-79
• CAPEC-310