Highcharts Grid: Cross-site scripting via custom icon definitions
Summary
Highcharts Grid (grid-lite and grid-pro npm packages) from 2.3.0 before 3.2.0 copies arbitrary keys of custom icon definitions as attributes onto SVG path elements, including event handler attributes. An attacker who can influence the Grid configuration can replace default sort or pagination icons with a malicious one, so script runs in the origin of the hosting page when a user hovers over or activates the icon. Exploitation requires that untrusted data reach the Grid configuration and that a user interacts with the icon.
Affected
- @highcharts/grid-lite: >= 2.3.0, < 3.2.0
- @highcharts/grid-pro: >= 2.3.0, < 3.2.0
- Core highcharts package scope: unconfirmed, the vendor advisory covers only Grid
Fixed in
- Upgrade to @highcharts/grid-lite and @highcharts/grid-pro 3.2.0 or later
Workaround
- Restrict who or what can write Grid rendering.icons options.
- If the configuration comes from sources you do not fully control, apply the sanitising snippet from the vendor advisory GHSA-6g3c-p4fg-xv47 and test it before relying on it.
Exploitation
- No confirmed exploitation according to available sources; not listed in CISA KEV.
- One unverified aggregator digest shows a proof-of-concept count; treat as an unconfirmed signal that public PoC code may exist.
Our recommendation
- Inventory projects using @highcharts/grid-lite or @highcharts/grid-pro (package.json, lockfiles, CDN URLs).
- Upgrade to version 3.2.0 or later.
- If users, customers or external data can influence Grid configuration, apply the interim guidance now and review who can change those settings.
- Recheck the NVD entry and the GHSA for updates, as NVD analysis is pending.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6g3c-p4fg-xv47 github.com
- Fix commit 8fc9706 github.com
- OSV GHSA-6g3c-p4fg-xv47 osv.dev
- GitLab Advisory CVE-2026-118242 (grid-pro) advisories.gitlab.com
- Highcharts Grid changelog changelog.highcharts.com
- npm package @highcharts/grid-lite www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 09:52.
Original description (NVD)
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.