Read the docs
TI-2026-82140 Aliases CVE-2026-118253GHSA-58g7-7f52-h92c

Cross-site scripting in Highcharts Dashboards fullscreen labels

Priority LOW 39CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Highcharts Dashboards from 1.0.0 before 4.2.3 parses fullscreen language labels as HTML instead of inserting them as text. This cross-site scripting flaw (CWE-79) lets an attacker who controls the Dashboards language options supply markup with event handlers. The injected script runs in the hosting page origin when the fullscreen control is rendered, and a low-privileged user must interact with the page for this to happen.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed highcharts (highcharts): 13.0.0-beta.2dashboards (@highcharts): 4.2.3+1 more product

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
highchartshighchartsbefore 13.0.0-beta.213.0.0-beta.2Patch availableCNA
highchartsdashboards1.0.0 to before 4.2.34.2.3Patch availableCNA
—@highcharts/dashboards (npm)1.0.0 to before 4.2.34.2.3Patch availableGHSA-58g7-7f52-h92c
  • highcharts Vendorhighcharts Affected before 13.0.0-beta.2 Fixed in 13.0.0-beta.2 Patch available CNA
  • dashboards Vendorhighcharts Affected 1.0.0 to before 4.2.3 Fixed in 4.2.3 Patch available CNA
  • @highcharts/dashboards (npm) Vendor— Affected 1.0.0 to before 4.2.3 Fixed in 4.2.3 Patch available GHSA-58g7-7f52-h92c

Remediation

Update @highcharts/dashboards to version 4.2.3, which fixes the flaw. The sources list no fixed version for highcharts.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA highcharts (highcharts) Fixed in 13.0.0-beta.2
  • Fix · CNA dashboards (@highcharts) Fixed in 4.2.3
  • Fix · GHSA-58g7-7f52-h92c @highcharts/dashboards (npm) Fixed in 4.2.3 Advisory →

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118253
  2. 2026-10-28 Alias added: GHSA-58g7-7f52-h92c
  3. 2026-10-28 Fix available: npm/@highcharts/[email protected] · GHSA-58g7-7f52-h92c
  4. 2026-10-28 CVSS score added · GHSA-58g7-7f52-h92c
  5. 2026-10-28 Weakness changed · GHSA-58g7-7f52-h92c
  6. 2026-10-28 4 new references · GHSA-58g7-7f52-h92c
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-10-29 Priority changed: MEDIUM → LOW

References

Other 4

  • TI-2026-82141 Highcharts Grid parses pagination language options as HTML CVSS 4.0HIGH 8.6
  • TI-2026-82139 Cross-site scripting in Highcharts Dashboards sidebar labels CVSS 4.0HIGH 8.4
  • TI-2026-82131 Cross-site scripting in Highcharts Dashboards via chartConstructor CVSS 4.0HIGH 8.6
  • TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
  • TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
  • TI-2018-14772 In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular… CVSS 3.0HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences