{
  "@id": "urn:uuid:2408c5fc-74e8-4008-bf03-ae673925e716",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-11-14T02:11:00.074412+00:00",
  "statements": [
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@9.2.2",
          "identifiers": {
            "purl": "pkg:npm/highcharts@9.2.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:08:55.229671+00:00",
      "status_notes": "Vulnerability CVE-2026-116796 does not affect version 9.2.2 of highcharts. not_affected \u2014 Highcharts 9.2.2 is not affected. The sanitiser AST.filterUserAttributes only keeps attributes listed in AST.allowedAttributes. That list contains 'href' and 'src' but not 'xlink:href'. An anchor carrying an xlink:href javascript: URL therefore has the attribute dropped and a warning logged. The flaw in the advisory is that xlink:href is accepted without the scheme check. That only exists in 10...",
      "vulnerability": {
        "name": "CVE-2026-116796"
      },
      "impact_statement": "not_affected \u2014 Highcharts 9.2.2 is not affected. The sanitiser AST.filterUserAttributes only keeps attributes listed in AST.allowedAttributes. That list contains 'href' and 'src' but not 'xlink:href'. An anchor carrying an xlink:href javascript: URL therefore has the attribute dropped and a warning logged. The flaw in the advisory is that xlink:href is accepted without the scheme check. That only exists in 10..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@9.2.2",
          "identifiers": {
            "purl": "pkg:npm/highcharts@9.2.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:11:00.074412+00:00",
      "status_notes": "Vulnerability CVE-2026-118244 does not affect version 9.2.2 of highcharts. not_affected \u2014 Highcharts 9.2.2 predates the vulnerable architecture (advisory range 12.0.0-13.0.2). Its AST.parseMarkup has no Trusted Types policy and no per-call try/catch around DOMParser, so a throw during a beforeprint handler cannot divert markup to an unsanitized innerHTML assignment. The innerHTML fallback is chosen once at load time, only for browsers with no usable DOMParser text/html support (the ...",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-118244"
      },
      "impact_statement": "not_affected \u2014 Highcharts 9.2.2 predates the vulnerable architecture (advisory range 12.0.0-13.0.2). Its AST.parseMarkup has no Trusted Types policy and no per-call try/catch around DOMParser, so a throw during a beforeprint handler cannot divert markup to an unsanitized innerHTML assignment. The innerHTML fallback is chosen once at load time, only for browsers with no usable DOMParser text/html support (the ..."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@9.2.2",
          "identifiers": {
            "purl": "pkg:npm/highcharts@9.2.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:09:07.379949+00:00",
      "status_notes": "Vulnerability CVE-2026-118246 does not affect version 9.2.2 of highcharts. not_affected \u2014 Target is Highcharts 9.2.2 (highcharts-dist build). The breadcrumbs feature (drilldown.breadcrumbs, navigation.breadcrumbs, series breadcrumbs, and the breadcrumbs.style option) was added after this version. Nothing named \"breadcrumb\" exists in the tree, so the CVE's attacker input has no entry point. Not affected (Type A1).",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-118246"
      },
      "impact_statement": "not_affected \u2014 Target is Highcharts 9.2.2 (highcharts-dist build). The breadcrumbs feature (drilldown.breadcrumbs, navigation.breadcrumbs, series breadcrumbs, and the breadcrumbs.style option) was added after this version. Nothing named \"breadcrumb\" exists in the tree, so the CVE's attacker input has no entry point. Not affected (Type A1)."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@9.2.2",
          "identifiers": {
            "purl": "pkg:npm/highcharts@9.2.2"
          }
        }
      ],
      "timestamp": "2026-11-14T02:10:00.079064+00:00",
      "status_notes": "Vulnerability CVE-2026-118249 does not affect version 9.2.2 of highcharts. not_affected \u2014 Highcharts 9.2.2 predates the column-based data model that the CVE exploits. Point option keys are never used as data column ids here, so attacker-controlled `__proto__` or `constructor` keys in point objects cannot write integer-keyed values onto Object.prototype. Type A2: the chain from Input to Goal is absent.",
      "justification": "vulnerable_code_not_in_execute_path",
      "vulnerability": {
        "name": "CVE-2026-118249"
      },
      "impact_statement": "not_affected \u2014 Highcharts 9.2.2 predates the column-based data model that the CVE exploits. Point option keys are never used as data column ids here, so attacker-controlled `__proto__` or `constructor` keys in point objects cannot write integer-keyed values onto Object.prototype. Type A2: the chain from Input to Goal is absent."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@9.2.2",
          "identifiers": {
            "purl": "pkg:npm/highcharts@9.2.2"
          }
        }
      ],
      "timestamp": "2026-10-28T20:58:31.605031+00:00",
      "status_notes": "Vulnerability CVE-2026-118250 affects version 9.2.2 of highcharts.",
      "vulnerability": {
        "name": "CVE-2026-118250"
      },
      "action_statement": "Vulnerability CVE-2026-118250 affects version 9.2.2 of highcharts."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@9.2.2",
          "identifiers": {
            "purl": "pkg:npm/highcharts@9.2.2"
          }
        }
      ],
      "timestamp": "2026-10-28T20:58:09.118737+00:00",
      "status_notes": "Vulnerability CVE-2026-118251 affects version 9.2.2 of highcharts.",
      "vulnerability": {
        "name": "CVE-2026-118251"
      },
      "action_statement": "Vulnerability CVE-2026-118251 affects version 9.2.2 of highcharts."
    }
  ]
}