Highcharts Grid credits link runs script from javascript URL
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- Active
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Cross-site scripting
- Confidentiality · integrity · availability
- High · High · None
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-79.
Summary
Highcharts Grid Pro (@highcharts/grid-pro) from 2.0.0 before 3.2.0 applies credits.href to the credits link without validating the URL scheme (CWE-79). An attacker who controls the Grid configuration can supply a javascript URL, and when a user activates the credits link, the script runs in the origin of the hosting page with access to that application's data and session state. Highcharts Dashboards (@highcharts/dashboards) from 3.2.0 before 4.0.0 and highcharts before 13.0.0-beta.2 are also listed as affected.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
Description from the CNA
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state.This issue is fixed in Grid Pro 3.2.0.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| highcharts | highcharts | before 13.0.0-beta.2 | 13.0.0-beta.2 | Patch available | CNA |
| highcharts | dashboards | 3.2.0 to before 4.0.0 | 4.0.0 | Patch available | CNA |
| highcharts | grid-pro | 2.0.0 to before 3.2.0 | 3.2.0 | Patch available | CNA |
| — | @highcharts/dashboards (npm) | 3.2.0 to before 4.0.0 | 4.0.0 | Patch available | GHSA-6hgp-fmhr-mrg4 |
| — | @highcharts/grid-pro (npm) | 2.0.0 to before 3.2.0 | 3.2.0 | Patch available | GHSA-6hgp-fmhr-mrg4 |
- highcharts Vendorhighcharts Affected before 13.0.0-beta.2 Fixed in 13.0.0-beta.2 Patch available CNA
- dashboards Vendorhighcharts Affected 3.2.0 to before 4.0.0 Fixed in 4.0.0 Patch available CNA
- grid-pro Vendorhighcharts Affected 2.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available CNA
- @highcharts/dashboards (npm) Vendor— Affected 3.2.0 to before 4.0.0 Fixed in 4.0.0 Patch available GHSA-6hgp-fmhr-mrg4
- @highcharts/grid-pro (npm) Vendor— Affected 2.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available GHSA-6hgp-fmhr-mrg4
Remediation
Upgrade @highcharts/grid-pro to 3.2.0, @highcharts/dashboards to 4.0.0 and highcharts to 13.0.0-beta.2 or later.
Written with Claude Haiku 5.5 from the sources below · 2026-11-06
- Fix · CNA highcharts (highcharts) Fixed in 13.0.0-beta.2
- Fix · CNA dashboards (@highcharts) Fixed in 4.0.0
- Fix · CNA grid-pro (@highcharts) Fixed in 3.2.0
- Fix · GHSA-6hgp-fmhr-mrg4 @highcharts/dashboards (npm) Fixed in 4.0.0 Advisory →
- Fix · GHSA-6hgp-fmhr-mrg4 @highcharts/grid-pro (npm) Fixed in 3.2.0 Advisory →
Vendor assessments
Timeline
- 2026-10-28 Threatist record created from CVE-2026-118255
- 2026-10-28 Alias added: GHSA-6hgp-fmhr-mrg4
- 2026-10-28 Fix available: npm/@highcharts/[email protected], npm/@highcharts/[email protected] · GHSA-6hgp-fmhr-mrg4
- 2026-10-28 CVSS score added · GHSA-6hgp-fmhr-mrg4
- 2026-10-28 Weakness changed · GHSA-6hgp-fmhr-mrg4
- 2026-10-28 5 new references · GHSA-6hgp-fmhr-mrg4
- 2026-10-30 Priority changed: MEDIUM → LOW
- 2026-11-02 CISA SSVC decision points changed
- 2026-11-06 Affected versions changed · Red Hat
- 2026-11-06 CVSS score added · Red Hat
References
Other 5
- https://github.com/highcharts/highcharts/security/advisories/GHSA-6hgp-fmhr-mrg4
- https://github.com/highcharts/highcharts/pull/25351
- https://github.com/highcharts/highcharts/commit/45b74403acafbe9f621c4a343506721d9129e991
- https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0
- https://github.com/highcharts/highcharts
More highcharts vulnerabilities
- TI-2026-82141 Highcharts Grid parses pagination language options as HTML CVSS 4.0HIGH 8.6
- TI-2026-82140 Cross-site scripting in Highcharts Dashboards fullscreen labels CVSS 4.0HIGH 8.4
- TI-2026-82139 Cross-site scripting in Highcharts Dashboards sidebar labels CVSS 4.0HIGH 8.4
- TI-2026-82131 Cross-site scripting in Highcharts Dashboards via chartConstructor CVSS 4.0HIGH 8.6
- TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
- TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
Sources
- CVE-2026-118255 · CVE Program
- CVE-2026-118255 · NVD
- FIRST EPSS
- GHSA-6hgp-fmhr-mrg4 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-118255 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences