Highcharts JS does not filter attribute names when applying the breadcrumbs.style option, allowing an attacker who can supply chart configuration to embed SVG event‑handler attributes. Those attributes translate directly into executable JavaScript in the page’s origin context after a user navigates the breadcrumb trail and interacts with the button, creating a cross‑site scripting vector that can run arbitrary code, steal data, or perform other malicious actions.

Desktop or web applications that embed Highcharts versions 10.0.0 through 13.1.0 (excluding the patched releases) are affected. The fix is included in Highcharts v11.4.9, v12.6.1, and v13.1.0; earlier releases, as well as those between the stated ranges, remain vulnerable. Styled‑mode charts, which use CSS instead of SVG, are not impacted.

The CVSS base score is 8.4, indicating high severity. EPSS is not publicly available, and the flaw is not listed in the CISA KEV catalog, but the lack of a KEV listing does not reduce its potential risk. The vulnerability requires that an attacker supply a crafted configuration file or JSON payload that the charting library will interpret. Once rendered, the browser must display the breadcrumb elements and the attacker must trigger a navigation or hover action, making the attack somewhat user‑dependent but still feasible in a public‑facing web page.