Vue I18n versions prior to 11.4.14 and certain alpha versions of 12.0.0 contain a vulnerability where the escapeParameter feature does not properly sanitize the srcdoc attribute in iframe elements within translation messages. This allows an attacker to inject HTML content that the browser decodes and executes in the same origin, leading to DOM-based cross-site scripting (XSS). The issue arises because the sanitizer escapes characters using character references that are decoded inside srcdoc, bypassing the sanitization. The vulnerability is fixed in versions 11.4.14 and 12.0.0-alpha.5.
A cookie scoping vulnerability in happy-dom allows an attacker origin to set cookies that a victim origin receives, violating standard browser cookie domain matching rules. This occurs because happy-dom uses a suffix match without enforcing DNS label boundaries, enabling cross-origin cookie injection. The issue affects server-side rendering or prerendering scenarios where happy-dom handles cookies. A proof-of-concept demonstrates an attacker setting a cookie for 'localhost' from '127.0.0.1', which a real browser would reject but happy-dom accepts. This can lead to session fixation or other cookie-based attacks.
A vulnerability in the @graphql-tools/executor-legacy-ws package causes per-request WebSocket connection parameters to persist across different users. This stale authentication state leads to later users inheriting previous users' authentication credentials in the connection_init payload, potentially allowing unauthorized access to downstream GraphQL subscriptions. The issue affects versions prior to 1.1.36 and is fixed in version 1.1.36.
A cross-tenant data leak vulnerability exists in the npm package @graphql-tools/executor-legacy-ws (versions up to 1.1.35). The legacy WebSocket executor reuses a single WebSocket and overwrites its onmessage handler on each subscription, causing subscription results to be delivered to the wrong caller without verifying operation IDs. This leads to one user receiving another user's private subscription data while the original subscriber stops receiving their own data.
The @hono/node-server package's serveStatic function decodes the request path twice, allowing a crafted request to bypass middleware mounted on static file prefixes. This occurs because the router matches the encoded path after the first decode, but serveStatic resolves the file after a second decode, causing middleware to be skipped. The vulnerability does not allow directory traversal outside the configured root. It affects versions from 1.19.10 up to but not including 2.1.3. A fix is available in version 2.1.3.
The npm package @zaip-ai/cli contains malicious code that compromises any computer on which it is installed or run. The compromise is severe enough that all secrets and keys stored on the affected system should be rotated immediately from a different, uncompromised machine. Removal of the package alone does not guarantee elimination of all malicious software introduced by the package.
CVE-2026-118255 is a high-severity vulnerability in Highcharts Grid where an attacker controlling the Grid configuration can set the credits.href property to a javascript: URL. This URL is not validated, allowing execution of arbitrary script in the context of the hosting page when a user clicks the credits link. The vulnerability requires that untrusted data reach the Grid configuration and that a user activates the link. Patched versions 3.2.0 and 4.0.0 address this issue.
A vulnerability in @highcharts/grid-lite prior to version 3.2.0 allows an attacker controlling pagination language options to inject HTML with event handlers into the DOM. This occurs because pagination language strings are parsed as markup rather than text, enabling script execution in the page's origin when pagination is enabled and untrusted data is supplied. A patch is available in version 3.2.0 to address this issue.
Highcharts Dashboards versions from 1.0.0 up to but not including 4.2.3 contain a vulnerability where fullscreen labels in edit mode are parsed as HTML. An attacker controlling the Dashboards language options can inject markup with event handlers that execute scripts in the context of the hosting page. This allows script execution with the same access as the hosting application. A patch is available in version 4.2.3. Workarounds include replacing the vulnerable method to use textContent instead of innerHTML or disabling edit mode and the related context menu item.
Highcharts Dashboards versions prior to 4.2.3 parse sidebar component language strings as HTML instead of plain text. This allows an attacker who can control these language options to inject malicious markup with event handlers, which execute in the context of the hosting page when the sidebar is rendered in edit mode. Exploitation requires untrusted data to reach the language configuration and a user to open the edit mode sidebar. A patched version 4.2.3 is available that properly escapes these labels to prevent HTML injection.
Highcharts versions prior to 11.4.9, between 12.0.0 and 12.6.1, and between 13.0.0 and 13.1.0 contain a vulnerability where the credits.href property can be set to a javascript: URL. This causes the script to run in the context of the hosting page when the credits label is clicked. An attacker controlling chart configuration can exploit this if untrusted data reaches the chart and a user clicks the credits label. Patched versions 11.4.9, 12.6.1, and 13.1.0 fix this issue.
Highcharts versions 6.1.0 through 11.4.8, 12.0.0 through 12.6.0, and 13.0.0 through 13.0.9 contain a vulnerability where an attacker controlling the series.keys and point data can write arbitrary properties to Object.prototype via dot-separated key paths. This can lead to prototype pollution visible to all JavaScript on the page without user interaction. The impact depends on how the application uses these properties. Patched versions 11.4.9, 12.6.1, and 13.1.0 are available.
Highcharts versions from 13.0.0 up to but not including 13.1.0 contain a prototype pollution vulnerability in the series column construction. This occurs because point option keys are used directly as data column IDs, allowing keys named __proto__ and constructor to write to Object.prototype. This causes integer-keyed properties to be set on Object.prototype, affecting all objects on the page and potentially disrupting rendering and logic. The vulnerability is fixed in version 13.1.0.
A vulnerability in Highcharts Core allows attacker-controlled keys in the breadcrumbs.style option to be interpreted as SVG event-handler attributes, enabling script execution in the page origin. This affects charts using drilldown.breadcrumbs, navigation.breadcrumbs, and breadcrumbs options in hierarchical series like treemap, sunburst, and treegraph. Exploitation requires untrusted data in chart configuration and user interaction with breadcrumb buttons. Charts rendered in styled mode are not affected. Patched versions are available.
Highcharts Grid Pro versions >=2.0.0 <3.2.0 and >=3.6.0 <4.0.0 contain a vulnerability where cell-renderer attributes are applied directly to input or select elements without validation. This allows an attacker controlling the Grid configuration to inject event handler attributes, leading to execution of arbitrary code in the page's origin when a user interacts with the rendered inputs. The issue affects both view and edit-mode renderers. Patched versions 3.2.0 and 4.0.0 are available.
A vulnerability in Highcharts Grid's custom icon handling allows an attacker controlling the Grid configuration to inject event handler attributes into SVG path elements. This occurs because the icon definition objects are written with raw setAttribute calls on <path> elements without filtering attribute names, enabling execution of attacker-supplied handlers in the page origin. Exploitation requires untrusted data to reach the Grid configuration and user interaction with the affected icons. The issue is fixed in version 3.2.0.
Highcharts Dashboards contains a vulnerability where the 'chartConstructor' property is used without validation to select a function from the Highcharts namespace. This allows an attacker controlling the dashboard configuration to invoke unintended functions, potentially injecting markup and event handlers that execute in the page's origin. Exploitation requires that untrusted data reach the Dashboards component configuration, with no user interaction needed beyond rendering the dashboard. A patch is available in version 4.2.2.
CVE-2026-118247 is a vulnerability in Highcharts Dashboards and Grid Pro where untrusted column IDs such as '__proto__' or 'constructor' can be used to write properties onto Object.prototype. This occurs because the DataTable.setCell method and related column writers do not filter these special keys, allowing attacker-controlled data to affect all objects in the page. The impact includes unexpected behavior in unrelated code and rendering failures. Exploitation requires untrusted data to reach the board or grid configuration and a cell or point update. Patched versions 4.2.2 and 3.2.0 are available, and workarounds include stripping unsafe keys from column data and patching DataTable methods to ignore these keys.
Highcharts Dashboards versions 1.0.0 through 4.2.1 have a vulnerability where a specially crafted data table id of '__proto__' can cause the library to write enumerable properties to Object.prototype. This occurs because the data cursor uses plain objects keyed by table id, and '__proto__' resolves to Object.prototype, leading to pollution of the global object prototype. This can disrupt sync features like 'highlight' or 'extremes' that rely on lasting state. Exploitation requires untrusted data reaching the dashboard configuration with an enabled sync on the affected table. A patch is available in version 4.2.2.
Highcharts Core versions 12.0.0 through 12.6.0 and 13.0.0 through 13.0.9 contain a vulnerability where HTML text parsing falls back to unfiltered innerHTML during printing in Chromium browsers. This fallback can lead to unsanitized HTML insertion and execution of embedded event handlers if the chart is re-rendered from a beforeprint handler, potentially allowing script execution in the page's origin. The issue affects charts built with Highcharts Core, Stock, Maps, and Gantt. Patched versions 12.6.1 and 13.1.0 are available.