Highcharts Grid: Cross-site scripting via pagination language options
Summary
Highcharts Grid (@highcharts/grid-lite and @highcharts/grid-pro) from 2.0.0 before 3.2.0 writes pagination language strings into the DOM as HTML instead of text. If an attacker can control the Grid language configuration, injected elements with event handlers run in the origin of the hosting web page when the pagination controls render. Pagination must be enabled, and no additional user interaction is required beyond loading the page.
Affected
- @highcharts/grid-lite: >= 2.0.0, < 3.2.0
- @highcharts/grid-pro: >= 2.0.0, < 3.2.0
- highcharts (Highcharts JS Core): < 13.0.0-beta.2 according to the CNA record, unverified; a related advisory gives different versions, to be confirmed with the vendor
Fixed in
- @highcharts/grid-lite and @highcharts/grid-pro: 3.2.0
- Highcharts Core: Unknown (to be confirmed with Highsoft)
Workaround
- Upgrading to 3.2.0 is the fix.
- If an upgrade is blocked, sanitize or HTML-encode untrusted strings before they reach Grid language settings.
- The vendor advisory contains a workaround for cases where the Grid configuration is not fully controlled; read and test it in staging.
Exploitation
- A proof-of-concept is reported by a secondary source, not verified.
- Exploitation in the wild: Unknown.
- CISA KEV listing: Not listed according to a secondary source.
- NVD status at time of writing: Awaiting Analysis.
Our recommendation
- Inventory all web applications using @highcharts/grid-lite, @highcharts/grid-pro or highcharts, including lockfiles, CDN URLs and vendored copies.
- Upgrade the Grid packages to 3.2.0 and confirm the Highcharts Core version with the vendor.
- Prioritize applications where pagination language strings can come from users, CMS fields, databases or APIs.
- Until patched, restrict or sanitize these inputs.
- Note the severity discrepancy: CVSS 4.0 score 8.6 from the CNA, CVSS 3.1 score 9.6 from a GitLab mirror.
- Monitor the NVD record and the GitHub advisory for changes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-r5wg-q8fc-p6w2 github.com
- Fix commit 1e8ded8 github.com
- Release grid-v3.2.0 github.com
- Highcharts Grid changelog changelog.highcharts.com
- OSV GHSA-r5wg-q8fc-p6w2 osv.dev
- GitLab advisory (CVSS discrepancy) advisories.gitlab.com
- VulDB CVE-2026-118254 vuldb.com
- CVE Reports CVE-2026-118254 (secondary) cvereports.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 06:55.
Original description (NVD)
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.