CVE-2026-118242
HighCVSS 8.5Exploitation Probability (EPSS)
Low risk23th percentile - higher than 23% of all known CVEs
Summary
Highcharts Grid creates SVG path elements from rendering.icons definitions and previously copied every child key with setAttribute. An attacker controlling Grid configuration can supply event-handler attribute names in an icon definition and replace default sort or pagination icons, causing script execution in the hosting page origin when a user hovers over or activates the icon. This is fixed in 3.2.0.
Risk Assessment
Potential arbitrary script execution in the user's browser (XSS) in the hosting page origin, which may lead to session or data theft. Risk applies to applications where grid configuration comes from untrusted sources.
Recommendation
Update Highcharts Grid to version 3.2.0 or later. Additionally, do not allow icon configuration to be loaded from untrusted sources.
Other vulnerabilities in Highcharts Grid
See all- CVE-2026-118255High
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state. This issue is fixed in Grid Pro 3.2.0.
- CVE-2026-118254High
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.
Original NVD description (English source)
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS