Highcharts Dashboards: Cross-site scripting via unchecked chartConstructor lookup
Summary
Highcharts Dashboards, a JavaScript charting library for interactive dashboards, uses a configurable chartConstructor value without validating it against the supported chart types. An attacker who can influence the dashboard configuration can select a public utility function, which copies attacker-controlled markup and event handlers into the hosting page. The script then runs in the origin of the hosting web application when the dashboard is rendered, without further user interaction.
Affected
- @highcharts/dashboards (npm): versions 1.0.0 up to but excluding 4.2.2 (vendor advisory GHSA-grj7-r4jv-pw9j)
- The CVE record also lists the core highcharts package below 13.1.0 and Dashboards below 4.2.3. The vendor advisory does not confirm these ranges; verify with Highsoft.
Fixed in
- @highcharts/dashboards 4.2.2 (vendor fix, commit 98d3652)
- Secondary sources and the CVE record name 4.2.3; confirm the fixed version with Highsoft.
Workaround
- If an immediate upgrade is not possible, follow the temporary workaround in the vendor advisory: reset any chartConstructor value outside the supported list to the standard 'chart' constructor before rendering.
- Validate or restrict dashboard configurations that come from users or third parties.
Exploitation
- No public proof of concept found.
- Not known to be exploited in the wild (OffSeq).
- Not listed in the CISA KEV catalog; CISA SSVC assessment: exploitation none, automatable no.
- EPSS: 0.34 % (percentile 27).
Our recommendation
- Identify all applications that use @highcharts/dashboards, including CDN-loaded versions.
- Upgrade to version 4.2.2 or later as soon as possible; confirm with the vendor whether 4.2.3 is required.
- Until patched, restrict who can create or modify dashboard configurations and validate imported board definitions.
- Assess the exposure: the risk is highest for multi-tenant portals, customer-facing reporting and saved user layouts. Static, developer-written dashboards without user-controlled configuration carry lower risk.
- Monitor NVD for the final analysis and check whether the core highcharts package is affected.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-grj7-r4jv-pw9j github.com
- Fix commit 98d3652 github.com
- Release dashboards-v4.2.2 github.com
- OSV GHSA-grj7-r4jv-pw9j osv.dev
- GitLab Advisory Database: @highcharts/dashboards advisories.gitlab.com
- Highcharts security overview github.com
- npm: @highcharts/dashboards www.npmjs.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:55.
Original description (NVD)
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes. Markup and event handlers can then execute in the hosting page origin when the board renders. No user interaction beyond rendering the board is required. This issue is fixed in 4.2.2.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.