{
  "@id": "urn:uuid:f7908df8-78b5-4515-882f-65bcf098bae0",
  "role": "Document Creator",
  "author": "https://tuxcare.com",
  "version": 6,
  "@context": "https://openvex.dev/ns/v0.2.0",
  "timestamp": "2026-10-30T13:29:32.974587+00:00",
  "statements": [
    {
      "status": "fixed",
      "products": [
        {
          "@id": "pkg:npm/highcharts@7.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/highcharts@7.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-09-24T09:31:26.931840+00:00",
      "status_notes": "Vulnerability CVE-2021-29489 is fixed in version 7.2.2-tuxcare.1 of highcharts.",
      "vulnerability": {
        "name": "CVE-2021-29489"
      }
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@7.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/highcharts@7.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T00:39:00.143564+00:00",
      "status_notes": "Vulnerability CVE-2026-116796 does not affect version 7.2.2-tuxcare.1 of highcharts. not_affected \u2014 CVE-2026-116796 concerns versions 10.3.2-13.1.0 where AST.filterUserAttributes validates href/src but misses xlink:href, allowing javascript: URLs in SVG anchors. Version 7.2.2 predates AST and uses buildText() which only extracts class/style/href from user markup (lines 2922-2932). User-provided xlink:href attributes are never extracted, validated, or preserved. The href attributes that ARE pr...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-116796"
      },
      "impact_statement": "not_affected \u2014 CVE-2026-116796 concerns versions 10.3.2-13.1.0 where AST.filterUserAttributes validates href/src but misses xlink:href, allowing javascript: URLs in SVG anchors. Version 7.2.2 predates AST and uses buildText() which only extracts class/style/href from user markup (lines 2922-2932). User-provided xlink:href attributes are never extracted, validated, or preserved. The href attributes that ARE pr..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@7.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/highcharts@7.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T20:58:09.118737+00:00",
      "status_notes": "Vulnerability CVE-2026-118244 affects version 7.2.2-tuxcare.1 of highcharts.",
      "vulnerability": {
        "name": "CVE-2026-118244"
      },
      "action_statement": "Vulnerability CVE-2026-118244 affects version 7.2.2-tuxcare.1 of highcharts."
    },
    {
      "status": "not_affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@7.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/highcharts@7.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T00:10:00.498064+00:00",
      "status_notes": "Vulnerability CVE-2026-118246 does not affect version 7.2.2-tuxcare.1 of highcharts. not_affected \u2014 Version 7.2.2 is not affected by CVE-2026-118246. The vulnerability specifically targets the breadcrumbs feature, which does not exist in this version. Version 7.2.2 uses the older drillUpButton navigation mechanism instead. Exhaustive search across the entire codebase found zero files containing \"breadcrumb\" references. The CVE describes breadcrumbs style options being applied as SVG attribute...",
      "justification": "vulnerable_code_not_present",
      "vulnerability": {
        "name": "CVE-2026-118246"
      },
      "impact_statement": "not_affected \u2014 Version 7.2.2 is not affected by CVE-2026-118246. The vulnerability specifically targets the breadcrumbs feature, which does not exist in this version. Version 7.2.2 uses the older drillUpButton navigation mechanism instead. Exhaustive search across the entire codebase found zero files containing \"breadcrumb\" references. The CVE describes breadcrumbs style options being applied as SVG attribute..."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@7.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/highcharts@7.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-28T20:58:09.118737+00:00",
      "status_notes": "Vulnerability CVE-2026-118249 affects version 7.2.2-tuxcare.1 of highcharts.",
      "vulnerability": {
        "name": "CVE-2026-118249"
      },
      "action_statement": "Vulnerability CVE-2026-118249 affects version 7.2.2-tuxcare.1 of highcharts."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@7.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/highcharts@7.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T13:29:32.974587+00:00",
      "status_notes": "Vulnerability CVE-2026-118250 affects version 7.2.2-tuxcare.1 of highcharts, and is fixed in 7.2.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-118250"
      },
      "action_statement": "Vulnerability CVE-2026-118250 affects version 7.2.2-tuxcare.1 of highcharts, and is fixed in 7.2.2-tuxcare.2."
    },
    {
      "status": "affected",
      "products": [
        {
          "@id": "pkg:npm/highcharts@7.2.2-tuxcare.1",
          "identifiers": {
            "purl": "pkg:npm/highcharts@7.2.2-tuxcare.1"
          }
        }
      ],
      "timestamp": "2026-10-30T13:29:32.974587+00:00",
      "status_notes": "Vulnerability CVE-2026-118251 affects version 7.2.2-tuxcare.1 of highcharts, and is fixed in 7.2.2-tuxcare.2.",
      "vulnerability": {
        "name": "CVE-2026-118251"
      },
      "action_statement": "Vulnerability CVE-2026-118251 affects version 7.2.2-tuxcare.1 of highcharts, and is fixed in 7.2.2-tuxcare.2."
    }
  ]
}