Highcharts assigns the credits.href property to the window location without validating the provided URL against an allowed scheme list. An attacker who controls the chart configuration can set a javascript URL in this field, and when a user clicks the credits label the script runs in the context of the hosting page, giving the attacker remote code execution capability. This flaw is a client‑side cross‑site scripting vulnerability (CWE‑79).

The vulnerability impacts the Highcharts JavaScript charting library, including the core Highcharts, Highcharts Stock, Maps, and Gantt packages. Versions prior to 11.4.9, 12.6.1, and 13.1.0 are affected; any application embedding these libraries without applying the patch is vulnerable.

The CVSS score of 8.4 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, but the risk remains significant because exploitation requires only a user interaction – clicking the credits label – after loading a chart from a compromised configuration. Attackers can supply malicious javascript URLs via chart options; when the user clicks the credits link, the script executes with the host page’s privileges. Because the flaw is client‑side and requires user interaction, the likelihood of exploitation depends on the frequency of chart usage and user behavior. This combination of high severity and user‑triggered exploitation warrants concern for any publicly exposed pages using the affected Highcharts versions.