CVE-2026-118242 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JS versions ranging from 2.3.0 to 3.2.0 represents a significant cross-site scripting risk rooted in improper input validation and unsafe DOM manipulation practices. As a widely adopted JavaScript charting library that relies on SVG for rendering visualizations, Highcharts processes configuration objects provided by developers or end-users to generate graphical elements. The specific flaw resides within the Grid component's handling of icon definitions during the creation of SVG path elements from the rendering.icons object. In these affected versions, the code logic indiscriminately copied every child key present in the input data and applied it directly to the DOM element using setAttribute without sufficient sanitization or validation against a whitelist of allowed attributes. This architectural oversight allows an attacker who has control over the Grid configuration payload to inject malicious attribute names that correspond to event handlers, such as onmouseover or onclick.
The operational impact of this vulnerability is severe because it enables stored or reflected cross-site scripting attacks depending on how the chart data is persisted and served. Since custom icons defined in the configuration override built-in default icons for actions like sorting columns or paginating through data sets, an attacker can seamlessly replace standard UI elements with malicious counterparts containing embedded JavaScript event handlers. When a victim user interacts with these compromised charts by hovering over or clicking on the affected sort or pagination icons, the browser executes the injected script within the context of the hosting page's origin. This bypasses same-origin policy protections because the code runs as if it were part of the legitimate application, granting the attacker access to sensitive cookies, session tokens, and potentially allowing for account takeover or data exfiltration from other domains accessible via the victim's browser history.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the injection of executable code through attribute values that are interpreted by the browser rather than treated as static data. Furthermore, in the context of the MITRE ATT&CK framework, this behavior maps to T1059, Command and Scripting Interpreter, specifically JavaScript execution within a web client environment. It also relates to T1189, Drive-by Client-side Execution, if exploited via phishing or compromised websites that host vulnerable Highcharts instances without requiring direct user interaction beyond standard navigation, although the specific requirement for hover or click activation places it closer to interactive exploitation vectors like T1204, User Execution.
Mitigation strategies must address both immediate remediation and long-term defensive coding practices. The primary and most effective solution is to upgrade the Highcharts library to version 3.2.0 or later, where this issue has been resolved through improved input validation that restricts attribute setting to a safe subset of properties. For environments unable to immediately patch due to dependency constraints, developers should implement strict server-side sanitization of all chart configuration data before it is rendered in the browser. This involves validating icon definitions against an allowlist of permitted attributes and stripping any event handler prefixes such as on from user-supplied input. Additionally, implementing Content Security Policy headers can provide a layer of defense by restricting the sources from which scripts are allowed to execute, thereby mitigating the impact even if script injection occurs. Regular security audits of third-party library configurations and continuous monitoring for unusual DOM manipulation patterns in client-side applications are also recommended to detect potential exploitation attempts early.