8.4
HighCVSS 4.0 · from GitHub_M
CVE-2026-118253
Highcharts Dashboards: fullscreen labels are parsed as HTML
highcharts · Cross-site scripting · CWE-79Affectedhighcharts, dashboards
FixNo fix listed yet.
PublishedOct 28, 18:11 · GitHub_M
ScoredOct 28 · 8.4 · GitHub_M
Exploit code publicNone known · checked 21:18 UTC
ExploitedNone known · CISA KEV checked 22:09 UTC
What we know
No known exploitation. CISA KEV, checked 22:09 UTC.
No public exploit code known. Exploit-DB, Metasploit, Nuclei, checked 21:18 UTC.
An attacker needs network access and an account. CVSS: network, low privileges.
Someone has to open, click or run something first. CVSS: user interaction required.
A successful attack can read data and change data. CVSS impact.
A successful attack gives full control of the affected system. CISA: technical impact total.
Description
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.
From GitHub_M
Affected and fixed versions
ProductAffectedFixed inhighcharts< 13.0.0-beta.2–dashboards>= 1.0.0, < 4.2.3–
Exploit code
Exploit-DBnone knownMetasploitnone knownNucleinone known