Highcharts Dashboards: Cross-site scripting in fullscreen language labels
Summary
Highcharts Dashboards parses fullscreen language labels in edit mode as HTML instead of plain text. An attacker who can control the Dashboards language options can inject markup with event handlers that run in the origin of the hosting page when the fullscreen control is rendered. The issue requires edit mode to be enabled and the viewFullscreen item to be present in the context-menu items. The CVSS 4.0 base score in the CVE data is 8.4 (HIGH), while the GitHub advisory mirror lists a different CVSS 3.1 vector and score.
Affected
- @highcharts/dashboards from 1.0.0 before 4.2.3
- The CNA data also lists the core highcharts package below 13.0.0-beta.2. The vendor advisory names only Dashboards, so whether core Highcharts is affected is unconfirmed.
Fixed in
- @highcharts/dashboards 4.2.3 (vendor fix, commit f97213b)
Workaround
No vendor workaround is documented. Upgrading to 4.2.3 or later is the stated fix.
- Disabling edit mode or removing the fullscreen menu item should remove the exposure (inference from the description, not a vendor statement).
- Do not let untrusted users or external data sources set the Dashboards language options, and sanitise such input server-side.
Exploitation
- No in-the-wild exploitation reported by the vendor or the CNA.
- CISA SSVC: exploitation none, automatable no, technical impact total.
- EPSS 0.42 % (percentile 36).
- Public proof of concept: unknown.
Our recommendation
- Upgrade @highcharts/dashboards to 4.2.3 or later.
- Check whether the npm package or the CDN-loaded dashboards.js is used in customer-facing applications.
- Where an upgrade is not immediately possible, disable edit mode or restrict who can set language options.
- Review whether dashboards are on internet-facing portals with logins, as this raises the priority.
- Check whether core Highcharts is in use and confirm its status with the vendor.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub commit f97213b (fix) github.com
- GitHub release dashboards-v4.2.3 github.com
- GitHub Security Advisory GHSA-58g7-7f52-h92c github.com
- Mirrored advisory (GitLab) advisories.gitlab.com
- OSV GHSA-58g7-7f52-h92c osv.dev
- VulDB entry 428148 vuldb.com
- Vulners CVE record vulners.com
- Highcharts changelog changelog.highcharts.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:54.
Original description (NVD)
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.