Highcharts Grid Pro: Cross-site scripting via cell renderer attributes
Summary
Highcharts Grid Pro copies the cell renderer attributes from column configuration onto input and select elements without filtering event-handler attributes. An attacker who can control the column configuration can add JavaScript event handlers that run in the origin of the hosting page when a user hovers over, focuses or edits a cell. The attack requires a logged-in user to interact with the grid, and the impact is session and action abuse in the page context.
Affected
- @highcharts/grid-pro: 2.0.0 to before 3.2.0
- @highcharts/dashboards (Pro DataGrid): 3.6.0 to before 4.0.0 according to the CVE record and GitHub advisory; a VulDB entry lists versions up to 3.1.9, which is not verified
- highcharts: 2.0.0 to before 3.2.0 (CVE record)
Fixed in
- @highcharts/grid-pro: 3.2.0
- @highcharts/dashboards: 4.0.0
Workaround
- Do not build grid column configuration from untrusted user input or unsanitised data.
- If the configuration comes from sources you do not fully control, apply a stopgap that filters renderer attributes to an allowlist. Only use the snippet from the vendor advisory and test it first.
Exploitation
- CISA SSVC: exploitation none, automatable no, total technical impact.
- No known in-the-wild exploitation reported.
- No public proof of concept confirmed.
Our recommendation
- Inventory @highcharts/grid-pro and @highcharts/dashboards in web applications, including vendor and SaaS products you operate.
- Upgrade to Grid Pro 3.2.0 or Dashboards 4.0.0. Confirm the Dashboards version mapping with the GitHub advisory first.
- Until the upgrade is done, prevent untrusted users from influencing column configuration.
- Prioritise internet-facing and multi-user applications such as custom dashboards and report builders.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-5ghw-9mgr-jvx2 github.com
- Fix commit 52abd4f8 github.com
- OSV GHSA-5ghw-9mgr-jvx2 osv.dev
- GitLab Advisory Database CVE-2026-116797 advisories.gitlab.com
- CVE record mirror CVE-2026-116797 cve.threatint.com
- Highcharts Grid documentation: general www.highcharts.com
- Highcharts Grid documentation: cell renderers highcharts.com
- VulDB entry 428142 (version discrepancy) vuldb.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:52.
Original description (NVD)
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column configuration can add event-handler attributes to every rendered row or to the control created when a cell enters edit mode. Script then runs in the hosting page origin when a user hovers over or focuses an input or begins editing. This issue is fixed in Grid Pro 3.2.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.