CVE-2026-118245 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes. Markup and event handlers can then execute in the hosting page origin when the board renders. No user interaction beyond rendering the board is required. This issue is fixed in 4.2.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JS, specifically affecting versions from 1.0.0 through 4.2.2 of the Dashboards component, stems from a critical flaw in how chart constructors are selected and instantiated. The core technical issue lies in the use of an unchecked property lookup mechanism where the library relies on the value provided for the chartConstructor parameter to determine which function within the Highcharts namespace should be invoked. This design decision fails to validate whether the specified constructor is one that is officially supported or intended for public consumption by dashboard configurations. Instead, the system blindly trusts this input and attempts to execute whatever property name is supplied as if it were a valid charting class.
This lack of validation allows an attacker who has control over the dashboard configuration payload to bypass expected behavior entirely. By substituting a legitimate chart constructor with a reference to any other public utility function or object method available within the Highcharts namespace, the attacker can manipulate how the library processes input data. When the system invokes this maliciously selected member, it passes along standard parameters such as the component container and chart options. Because these are not restricted to specific charting APIs, the arbitrary function receives arguments that may include user-controlled strings or objects intended for rendering visual elements.
The operational impact of this flaw is severe because it facilitates a Stored Cross-Site Scripting attack without requiring any interaction from end-users beyond viewing the compromised dashboard. When the board renders, the attacker-controlled options are copied directly into the container as properties or attributes on DOM elements. This process can inject malicious markup and event handlers that execute in the context of the hosting page's origin. Since the execution occurs during the rendering phase triggered by a simple page load or view action, there is no need for phishing tactics or social engineering to trick users into clicking specific links; the mere act of loading the dashboard triggers the exploitation chain.
From a classification perspective, this vulnerability aligns with CWE-20 Improper Input Validation and CWE-79 Cross-site Scripting. The failure to restrict input to a whitelist of expected constructors represents a fundamental breakdown in validation logic, allowing untrusted data to influence code execution paths. In terms of the MITRE ATT&CK framework, this behavior is consistent with techniques involving Client-side Injection, specifically leveraging DOM-based vectors where malicious scripts are injected into web pages viewed by other users through dynamic content manipulation rather than server-side storage alone.
Mitigation strategies must focus on strict input validation and restricting execution contexts. The primary fix implemented in version 4.2.2 involves validating the chartConstructor property against a predefined list of allowed constructors before invocation, ensuring that only legitimate charting classes can be instantiated by dashboard configurations. For organizations still running affected versions, immediate remediation is required to prevent unauthorized script execution. Additionally, implementing Content Security Policy headers with strict directives regarding script sources and inline event handlers can provide an additional layer of defense, limiting the impact even if such a vulnerability were present in other components. Regular updates to third-party JavaScript libraries are essential to maintain security posture against these types of client-side injection flaws.