Highcharts Grid Pro: Cross-site scripting via javascript: URL in credits link
Summary
Highcharts Grid Pro applies the configured credits.href value to the credits link without checking the URL scheme. An attacker who can control the Grid configuration can set a javascript: URL, and script then runs in the origin of the hosting page when a user clicks the credits link, with access to that application's data and session. Exploitation requires attacker influence over the configuration and a user click.
Affected
- Grid Pro (@highcharts/grid-pro): 2.0.0 up to before 3.2.0
- Advisory data also lists @highcharts/dashboards 3.2.0 up to before 4.0.0 and highcharts before 13.0.0-beta.2 (not verified)
- Grid Lite: possibly affected, not confirmed by the vendor
Fixed in
- Grid Pro 3.2.0 or later (vendor fix)
- Fixed versions for Dashboards and Highcharts core: Unknown.
Workaround
- Vendor workaround: Unknown (see GHSA advisory).
- Third-party suggestion, untested: remove credits.href or disable credits in untrusted configurations.
- Never build grid configuration from untrusted input.
Exploitation
- Public proof of concept: none found.
- Exploitation in the wild: none found; not checked against the CISA KEV catalogue.
- EPSS: 0.35 % (percentile 28).
Our recommendation
- Upgrade Grid Pro to 3.2.0 or later and batch it with other Grid advisories published on the same day.
- Check whether grid configuration comes from user-controlled data, databases or APIs, and prioritise these applications.
- If an upgrade is not possible immediately, apply the workaround only after testing it.
- Confirm Grid Lite and Dashboards versions with the vendor advisory.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- GitHub Security Advisory GHSA-6hgp-fmhr-mrg4 github.com
- Fix commit 45b7440 github.com
- Pull request #25351 github.com
- Highcharts Grid v3.2.0 release github.com
- OSV GHSA-6hgp-fmhr-mrg4 osv.dev
- GitLab Advisory Database: @highcharts/grid-pro CVE-2026-118255 advisories.gitlab.com
- Vulners CVE-2026-118255 vulners.com
- CVE Reports: CVE-2026-118255 cvereports.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 1 Nov 2026, 11:55.
Original description (NVD)
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state.This issue is fixed in Grid Pro 3.2.0.
NVD references (4)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.