Threats affecting pkg:github/highcharts/highcharts

Highcharts JS versions from 2.0.0 up to but not including 3.2.0 contain a cross-site scripting (XSS) vulnerability in the Grid pagination feature. The vulnerability arises because pagination language strings are written into the DOM as markup rather than text, allowing an attacker controlling the Grid language configuration to inject elements with event handlers. This leads to script execution in the context of the hosting page without requiring user interaction. The issue is fixed in version 3.2.0 and later.

CVE-2026-118253 is a high severity cross-site scripting (XSS) vulnerability in Highcharts JS versions from 1.0.0 up to but not including 4.2.3. The issue occurs in Highcharts Dashboards edit mode where fullscreen language labels are parsed as HTML instead of text, allowing an attacker controlling language options to inject malicious markup with event handlers. This code executes in the context of the hosting page when the fullscreen control is rendered. The vulnerability is only exploitable when edit mode is enabled and the fullscreen view option is present. The flaw is fixed in versions 4.2.3 and 13.0.0-beta.2.

CVE-2026-118247 is a prototype pollution vulnerability in Highcharts JS affecting versions prior to 13.1.0, Dashboards prior to 4.2.3, and Grid Pro prior to 3.2.0. The issue arises because DataTable single-cell writers use untrusted column IDs without filtering out __proto__ or constructor keys, allowing writes to Object.prototype or the Object constructor. This can alter application control flow or disrupt rendering. Exploitation requires control over table or component column IDs and cell or API writes. The vulnerability is fixed in Highcharts 13.1.0, Dashboards 4.2.3, and Grid Pro 3.2.0.

Highcharts JS versions from 1.0.0 up to but not including 4.2.3 contain a cross-site scripting (XSS) vulnerability in the Highcharts Dashboards feature. The issue arises because the dashboard uses an unchecked property lookup to invoke chart constructors, allowing an attacker controlling dashboard configuration to execute arbitrary markup and event handlers in the hosting page without user interaction. This vulnerability is fixed in versions 4.2.3 and 13.1.0.

Highcharts JS versions from 12.0.0 up to but not including 12.6.1, and from 13.0.0 up to but not including 13.1.0, are affected by a cross-site scripting (XSS) vulnerability. This occurs because Highcharts falls back to assigning raw markup to innerHTML when DOMParser fails, before applying its allow-list. In Chromium browsers, this can lead to execution of untrusted HTML event handlers during the beforeprint event when charts are redrawn. The vulnerability affects HTML-rendered titles, labels, data labels, responsive text, and related Highcharts products. The issue is fixed in versions 12.6.1 and 13.1.0.

CVE-2026-118242 is a high-severity cross-site scripting (XSS) vulnerability in Highcharts JS versions from 2.3.0 up to but not including 3.2.0. The flaw arises because Highcharts Grid creates SVG path elements from icon definitions and copies child keys with setAttribute, allowing an attacker controlling the Grid configuration to inject event-handler attributes. This enables script execution in the context of the hosting page when users interact with the malicious icons. The issue is fixed in version 3.2.0 and later.