Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118242 · GHSA-6g3c-p4fg-xv47

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Risk score
56/100
CVSS
8.5 v4.0
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon…
Affected
@highcharts/grid-lite (npm) >= 2.3.0, <= 3.1.0; @highcharts/grid-pro (npm) >= 2.3.0, <= 3.1.0
Fix
Upgrade @highcharts/grid-lite to 3.2.0; @highcharts/grid-pro to 3.2.0 or later.
Exploitation
No known exploitation

Story map

Story map: @highcharts/grid-liteTHE FLAWSTHE FIXCVE-2026-118242Highcharts Grid: custom icondefinition objects writtenwith raw `setAttribute` on…CVSS 8.5CVE-2026-118254Highcharts Grid parsespagination language options asHTMLCVSS 8.6Upgrade…3.2.0or later on your release lineWho is exposed@highcharts/grid-lite (npm) >=2.0.0, <= 3.1.0;@highcharts/grid-pro (npm) >=2.0.0, <= 3.1.0YELLOW · PLAN IT IN@highcharts/grid-liteHighcharts JS is a JavaScriptcharting library based on SVG.From 2.0.0 until 3.2.0,Highcharts Grid writespagination language strings intothe DOM as markup instead oftext. An attacker who controls…Where it standsNo known exploitationCONNECTS TOSame weaknessCross-site scripting (CWE-79)400 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@highcharts/grid-lite: Yellow, plan it in. Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin whe…

The flaws

  • CVE-2026-118242: Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` (CVSS 8.5)
  • CVE-2026-118254: Highcharts Grid parses pagination language options as HTML (CVSS 8.6)

The fix

Upgrade @highcharts/grid-lite: 3.2.0 or later on your release line

Who is exposed: @highcharts/grid-lite (npm) >= 2.0.0, <= 3.1.0; @highcharts/grid-pro (npm) >= 2.0.0, <= 3.1.0

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.5 high
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@highcharts/grid-litenpm>= 2.3.0, <= 3.1.03.2.0
@highcharts/grid-pronpm>= 2.3.0, <= 3.1.03.2.0

References

Original description

Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.