Highcharts Demo

by Black Label

HTML

<script src="https://code.highcharts.com/highcharts.js"></script>

<div id="container"></div>

JavaScript

// Workaround fix for all affected Highcharts versions: 5.0.0-13.0.2
!function(t){if(t&&t.Chart&&!t.Chart.prototype.creditsHrefPatched){var r=t.Chart.prototype,e=r.addCredits;r.addCredits=function(n){var o=t.merge(!0,this.options.credits,n);return o&&o.href&&!c(o.href)&&delete o.href,e.call(this,o)},r.creditsHrefPatched=!0}function c(r){var e=t.AST&&t.AST.allowedReferences||["https://","http://","mailto:","/","../","./","#"];return"string"==typeof r&&e.some(function(t){return 0===r.indexOf(t)})}}(Highcharts);
// End of the workaround fix

const chart = Highcharts.chart('container', {
  credits: {
    href: 'javascript:window.creditsXss = true;',
    text: 'Credits'
  },
  series: [
    {
      data: [5, 2, 3, 1, 4],
    },
  ],
});

chart.credits.element.dispatchEvent(new MouseEvent('click'));
setTimeout(() => console.info('creditsXss:', window.creditsXss));