8.4
HighCVSS 4.0 · from GitHub_M
CVE-2026-118252
Highcharts Dashboards: sidebar component labels are parsed as HTML
highcharts · Cross-site scripting · CWE-79Affectedhighcharts, dashboards
FixNo fix listed yet.
PublishedOct 28, 18:08 · GitHub_M
ScoredOct 28 · 8.4 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data and change data. CVSS impact.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing event handlers, which execute in the hosting page origin when a user opens the edit-mode sidebar and the affected labels render. This issue is fixed in 4.2.3.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inhighcharts< 13.0.0-beta.2–dashboards>= 1.0.0, < 4.2.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known