CVE-2026-118253 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JS versions ranging from 1.0.0 through 4.2.3 represents a classic Cross-Site Scripting (XSS) flaw rooted in improper input validation and the misuse of HTML rendering contexts for data that should be treated as plain text. Specifically, the defect resides in the edit mode functionality of Highcharts Dashboards, where language labels intended to populate user interface elements are parsed as raw HTML rather than being escaped or inserted as inert text nodes. This architectural decision creates a significant security gap because it allows any content embedded within these label strings to be interpreted and executed by the browser's rendering engine as active code rather than static display material. The core technical failure is an input validation error where user-supplied data, specifically language configuration options provided during dashboard setup or modification, is not sanitized before being injected into the Document Object Model via methods that support HTML parsing, such as innerHTML assignments without prior escaping.
From a threat modeling perspective, this vulnerability enables Stored Cross-Site Scripting if an attacker has control over the Dashboards language options within the application context. An adversary who can manipulate these configuration settings could inject malicious markup containing event handlers or script tags into the label fields. When another user subsequently interacts with the dashboard in edit mode and triggers the rendering of a fullscreen view, the browser processes this injected content as executable JavaScript. Because Highcharts Dashboards typically operate within the same origin as the hosting web application, the executed scripts inherit the full privileges of that origin. This means an attacker can perform actions on behalf of the victim user, such as stealing session cookies, accessing sensitive data displayed in the dashboard, or performing state-changing requests to backend APIs associated with the highcharts service.
The operational impact is constrained by specific contextual requirements that limit the attack surface but do not eliminate the severity for targeted attacks. The vulnerability is only exploitable when edit mode is explicitly enabled within the Highcharts Dashboards interface. Furthermore, the attacker must have control over the language options configuration to inject the malicious payload. Additionally, the execution context requires that viewFullscreen be present in the context-menu items of the dashboard being viewed. This means the attack relies on social engineering or prior compromise to get an administrator or authorized user into edit mode and then interact with a specific menu item that triggers the fullscreen rendering path where the unsanitized label is processed. Despite these constraints, the ability to execute arbitrary code in the host page origin poses a severe risk to data integrity and confidentiality within environments relying on Highcharts for critical business intelligence visualization.
Industry standards classify this flaw under CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism aligns with CWE-80, where the application fails to neutralize special characters before using them in a web page context that interprets HTML tags and attributes. In terms of offensive security frameworks, this vulnerability maps directly to MITRE ATT&CK technique T1059, specifically sub-technique 007 for JavaScript execution. The attack vector involves the attacker providing input (T1189) which is then processed by a trusted application component that executes it in a privileged context. This pattern highlights the danger of trusting configuration data without rigorous sanitization, especially when that data influences dynamic UI rendering logic.
Mitigation strategies must focus on both immediate patching and long-term defensive coding practices. The primary remediation is to upgrade Highcharts JS to version 4.2.3 or later, where this parsing behavior has been corrected to treat language labels as plain text rather than HTML content. For organizations unable to immediately apply the patch due to dependency constraints, a temporary workaround involves implementing strict input validation on any server-side endpoints that accept dashboard configuration updates. This includes enforcing allowlists for permitted characters in label fields and ensuring that all user-supplied strings are escaped using standard libraries before being passed to client-side rendering functions. Additionally, developers should review other areas of the Highcharts integration where dynamic content is injected into the DOM, applying Content Security Policy headers to restrict script execution origins as a defense-in-depth measure against potential exploitation vectors in related components.