Read the docs
TI-2026-82131 Aliases CVE-2026-118245GHSA-grj7-r4jv-pw9j

Cross-site scripting in Highcharts Dashboards via chartConstructor

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Highcharts Dashboards from 1.0.0 before 4.2.2 uses the chartConstructor setting as an unchecked lookup in the Highcharts namespace. An attacker who controls dashboard configuration can select a public utility function, which copies attacker-controlled options into the component container as properties or attributes (CWE-79). Markup and event handlers then run in the hosting page origin when the board renders, with no user interaction beyond rendering.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes. Markup and event handlers can then execute in the hosting page origin when the board renders. No user interaction beyond rendering the board is required. This issue is fixed in 4.2.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00337 27th percentileScored 2026-11-07
Fix Fixed highcharts (highcharts): 13.1.0dashboards (@highcharts): 4.2.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
highchartshighchartsbefore 13.1.013.1.0Patch availableCNA
highchartsdashboards1.0.0 to before 4.2.34.2.3Patch availableCNA
—@highcharts/dashboards (npm)1.0.0 to before 4.2.24.2.2Patch availableGHSA-grj7-r4jv-pw9j
  • highcharts Vendorhighcharts Affected before 13.1.0 Fixed in 13.1.0 Patch available CNA
  • dashboards Vendorhighcharts Affected 1.0.0 to before 4.2.3 Fixed in 4.2.3 Patch available CNA
  • @highcharts/dashboards (npm) Vendor— Affected 1.0.0 to before 4.2.2 Fixed in 4.2.2 Patch available GHSA-grj7-r4jv-pw9j

Remediation

Upgrade @highcharts/dashboards on npm to 4.2.2, which fixes this issue. The sources list no fixed version for highcharts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA highcharts (highcharts) Fixed in 13.1.0
  • Fix · CNA dashboards (@highcharts) Fixed in 4.2.3
  • Fix · GHSA-grj7-r4jv-pw9j @highcharts/dashboards (npm) Fixed in 4.2.2 Advisory →

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118245
  2. 2026-10-28 Alias added: GHSA-grj7-r4jv-pw9j
  3. 2026-10-28 Fix available: npm/@highcharts/[email protected] · GHSA-grj7-r4jv-pw9j
  4. 2026-10-28 CVSS score added · GHSA-grj7-r4jv-pw9j
  5. 2026-10-28 Weakness changed · GHSA-grj7-r4jv-pw9j
  6. 2026-10-28 5 new references · GHSA-grj7-r4jv-pw9j
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-10-29 Priority changed: MEDIUM → LOW

References

Advisory 1

Other 4

  • TI-2026-82141 Highcharts Grid parses pagination language options as HTML CVSS 4.0HIGH 8.6
  • TI-2026-82140 Cross-site scripting in Highcharts Dashboards fullscreen labels CVSS 4.0HIGH 8.4
  • TI-2026-82139 Cross-site scripting in Highcharts Dashboards sidebar labels CVSS 4.0HIGH 8.4
  • TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
  • TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
  • TI-2018-14772 In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular… CVSS 3.0HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences