Cross-site scripting in Highcharts Dashboards sidebar labels
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Highcharts Dashboards from 1.0.0 before 4.2.3 (npm package @highcharts/dashboards) parses component language strings in the edit-mode sidebar as HTML instead of inserting them as text. This is cross-site scripting (CWE-79). An attacker who controls the Dashboards language configuration can supply markup with event handlers that run in the hosting page origin when a user opens the edit-mode sidebar.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
Description from the CNA
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing event handlers, which execute in the hosting page origin when a user opens the edit-mode sidebar and the affected labels render. This issue is fixed in 4.2.3.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| highcharts | highcharts | before 13.0.0-beta.2 | 13.0.0-beta.2 | Patch available | CNA |
| highcharts | dashboards | 1.0.0 to before 4.2.3 | 4.2.3 | Patch available | CNA |
| — | @highcharts/dashboards (npm) | 1.0.0 to before 4.2.3 | 4.2.3 | Patch available | GHSA-rcqf-f6h2-ccg9 |
- highcharts Vendorhighcharts Affected before 13.0.0-beta.2 Fixed in 13.0.0-beta.2 Patch available CNA
- dashboards Vendorhighcharts Affected 1.0.0 to before 4.2.3 Fixed in 4.2.3 Patch available CNA
- @highcharts/dashboards (npm) Vendor— Affected 1.0.0 to before 4.2.3 Fixed in 4.2.3 Patch available GHSA-rcqf-f6h2-ccg9
Remediation
Upgrade @highcharts/dashboards to 4.2.3, the fixed version listed for npm. The sources list no fixed version for highcharts.
Written with Claude Haiku 5.5 from the sources below · 2026-10-30
- Fix · CNA highcharts (highcharts) Fixed in 13.0.0-beta.2
- Fix · CNA dashboards (@highcharts) Fixed in 4.2.3
- Fix · GHSA-rcqf-f6h2-ccg9 @highcharts/dashboards (npm) Fixed in 4.2.3 Advisory →
Timeline
- 2026-10-28 Threatist record created from CVE-2026-118252
- 2026-10-28 Alias added: GHSA-rcqf-f6h2-ccg9
- 2026-10-28 Fix available: npm/@highcharts/[email protected] · GHSA-rcqf-f6h2-ccg9
- 2026-10-28 CVSS score added · GHSA-rcqf-f6h2-ccg9
- 2026-10-28 Weakness changed · GHSA-rcqf-f6h2-ccg9
- 2026-10-28 4 new references · GHSA-rcqf-f6h2-ccg9
- 2026-10-30 Priority changed: MEDIUM → LOW
- 2026-10-30 CISA SSVC decision points changed
References
More highcharts vulnerabilities
- TI-2026-82141 Highcharts Grid parses pagination language options as HTML CVSS 4.0HIGH 8.6
- TI-2026-82140 Cross-site scripting in Highcharts Dashboards fullscreen labels CVSS 4.0HIGH 8.4
- TI-2026-82131 Cross-site scripting in Highcharts Dashboards via chartConstructor CVSS 4.0HIGH 8.6
- TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
- TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
- TI-2018-14772 In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular… CVSS 3.0HIGH 7.5
Sources
- CVE-2026-118252 · CVE Program
- CVE-2026-118252 · NVD
- FIRST EPSS
- GHSA-rcqf-f6h2-ccg9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences