Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118255 · GHSA-6hgp-fmhr-mrg4

Highcharts Grid: `javascript:` URL in credits.href runs script on click

Risk score
55/100
CVSS
8.4 v4.0
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hos…
Affected
@highcharts/dashboards (npm) >= 3.2.0, <= 3.6.0; @highcharts/grid-pro (npm) >= 2.0.0, <= 3.1.0
Fix
Upgrade @highcharts/dashboards to 4.0.0; @highcharts/grid-pro to 3.2.0 or later.
Exploitation
No known exploitation

Story map

Story map: @highcharts/dashboardsTHE FLAWSTHE FIXCVE-2026-118255Highcharts Grid: `javascript:`URL in credits.href runs scripton clickCVSS 8.4CVE-2026-118245Highcharts Dashboards:`chartConstructor` is anunchecked lookup into the…CVSS 8.6CVE-2026-118253Highcharts Dashboards parsesfullscreen labels as HTMLCVSS 8.4CVE-2026-118252Highcharts Dashboards parsessidebar component labels asHTMLCVSS 8.4Upgrade…4.2.2 · 4.2.3or later on your release lineWho is exposed@highcharts/dashboards (npm)>= 1.0.0, <= 4.2.1YELLOW · PLAN IT IN@highcharts/dashboardsHighcharts JS is a JavaScriptcharting library based on SVG.From 1.0.0 until 4.2.2,Highcharts Dashboards useschartConstructor as anunchecked property lookup in theHighcharts namespace and…Where it standsNo known exploitationCONNECTS TOSame weaknessCross-site scripting (CWE-79)400 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@highcharts/dashboards: Yellow, plan it in. Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration ca…

The flaws

  • CVE-2026-118255: Highcharts Grid: `javascript:` URL in credits.href runs script on click (CVSS 8.4)
  • CVE-2026-118245: Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace (CVSS 8.6)
  • CVE-2026-118253: Highcharts Dashboards parses fullscreen labels as HTML (CVSS 8.4)
  • CVE-2026-118252: Highcharts Dashboards parses sidebar component labels as HTML (CVSS 8.4)

The fix

Upgrade @highcharts/dashboards: 4.2.2 · 4.2.3 or later on your release line

Who is exposed: @highcharts/dashboards (npm) >= 1.0.0, <= 4.2.1

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 8.4 high
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
@highcharts/dashboardsnpm>= 3.2.0, <= 3.6.04.0.0
@highcharts/grid-pronpm>= 2.0.0, <= 3.1.03.2.0

References

Original description

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state.This issue is fixed in Grid Pro 3.2.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.