Read the docs
TI-2026-82141 Aliases CVE-2026-118254GHSA-r5wg-q8fc-p6w2

Highcharts Grid parses pagination language options as HTML

Priority MEDIUM 40CWE-79Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Cross-site scripting
Confidentiality · integrity · availability
High · High · None
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

Highcharts Grid packages @highcharts/grid-lite and @highcharts/grid-pro from 2.0.0 before 3.2.0 write pagination language strings into the DOM as markup, not text. An attacker with low privileges who controls the Grid language configuration (CWE-79) can supply elements with event handlers that run in the hosting page's origin when pagination controls render, with no user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00419 36th percentileScored 2026-11-07
Fix Fixed highcharts (highcharts): 13.0.0-beta.2grid-lite (@highcharts): 3.2.0+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
highchartshighchartsbefore 13.0.0-beta.213.0.0-beta.2Patch availableCNA
highchartsgrid-lite2.0.0 to before 3.2.03.2.0Patch availableCNA
highchartsgrid-pro2.0.0 to before 3.2.03.2.0Patch availableCNA
—@highcharts/grid-lite (npm)2.0.0 to before 3.2.03.2.0Patch availableGHSA-r5wg-q8fc-p6w2
—@highcharts/grid-pro (npm)2.0.0 to before 3.2.03.2.0Patch availableGHSA-r5wg-q8fc-p6w2
  • highcharts Vendorhighcharts Affected before 13.0.0-beta.2 Fixed in 13.0.0-beta.2 Patch available CNA
  • grid-lite Vendorhighcharts Affected 2.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available CNA
  • grid-pro Vendorhighcharts Affected 2.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available CNA
  • @highcharts/grid-lite (npm) Vendor— Affected 2.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available GHSA-r5wg-q8fc-p6w2
  • @highcharts/grid-pro (npm) Vendor— Affected 2.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available GHSA-r5wg-q8fc-p6w2

Remediation

Upgrade @highcharts/grid-lite and @highcharts/grid-pro to 3.2.0, and upgrade the highcharts package to 13.0.0-beta.2.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

  • Fix · CNA highcharts (highcharts) Fixed in 13.0.0-beta.2
  • Fix · CNA grid-lite (@highcharts) Fixed in 3.2.0
  • Fix · CNA grid-pro (@highcharts) Fixed in 3.2.0
  • Fix · GHSA-r5wg-q8fc-p6w2 @highcharts/grid-lite (npm) Fixed in 3.2.0 Advisory →
  • Fix · GHSA-r5wg-q8fc-p6w2 @highcharts/grid-pro (npm) Fixed in 3.2.0 Advisory →

Vendor assessments

Red Hat

Red Hat's page for this CVE →

Not affected: 1 product
  • Red Hat

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118254
  2. 2026-10-28 Alias added: GHSA-r5wg-q8fc-p6w2
  3. 2026-10-28 Fix available: npm/@highcharts/[email protected], npm/@highcharts/[email protected] · GHSA-r5wg-q8fc-p6w2
  4. 2026-10-28 CVSS score added · GHSA-r5wg-q8fc-p6w2
  5. 2026-10-28 Weakness changed · GHSA-r5wg-q8fc-p6w2
  6. 2026-10-28 4 new references · GHSA-r5wg-q8fc-p6w2
  7. 2026-10-30 Priority changed: MEDIUM → LOW
  8. 2026-11-03 CISA SSVC decision points changed
  9. 2026-11-03 Priority changed: LOW → MEDIUM
  10. 2026-11-06 Affected versions changed · Red Hat
  11. 2026-11-06 CVSS score added · Red Hat

References

Other 4

  • TI-2026-82140 Cross-site scripting in Highcharts Dashboards fullscreen labels CVSS 4.0HIGH 8.4
  • TI-2026-82139 Cross-site scripting in Highcharts Dashboards sidebar labels CVSS 4.0HIGH 8.4
  • TI-2026-82131 Cross-site scripting in Highcharts Dashboards via chartConstructor CVSS 4.0HIGH 8.6
  • TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
  • TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
  • TI-2018-14772 In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular… CVSS 3.0HIGH 7.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences