CVE-2026-118254
HighCVSS 8.6Exploitation Probability (EPSS)
Low risk36th percentile - higher than 36% of all known CVEs
Summary
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.
Risk Assessment
Script execution in the hosting page context without user interaction is possible, potentially leading to session or data theft. The risk affects applications with pagination enabled and language configuration from untrusted sources.
Recommendation
Update Highcharts Grid to version 3.2.0 (or later). Do not allow Grid language configuration from untrusted sources and validate language strings.
Other vulnerabilities in Highcharts Grid
See all- CVE-2026-118255High
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state. This issue is fixed in Grid Pro 3.2.0.
- CVE-2026-118242High
Highcharts Grid creates SVG path elements from rendering.icons definitions and previously copied every child key with setAttribute. An attacker controlling Grid configuration can supply event-handler attribute names in an icon definition and replace default sort or pagination icons, causing script execution in the hosting page origin when a user hovers over or activates the icon. This is fixed in 3.2.0.
Original NVD description (English source)
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS