CVE-2026-118254 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JS versions ranging from 2.0.0 through 3.2.0 represents a classic Cross-Site Scripting (XSS) flaw rooted in improper handling of user-supplied input during the rendering process. Specifically, the defect resides in how the Grid component processes pagination language strings. Instead of treating these configuration values as plain text data to be displayed within DOM elements, the library incorrectly interprets and injects them directly into the Document Object Model as raw HTML markup. This fundamental error in sanitization allows an attacker who has control over the Highcharts grid language configuration object to inject arbitrary JavaScript code alongside standard pagination labels. When the chart renders its pagination controls, the browser parses this injected content not as text but as executable script elements or event handler attributes, thereby executing malicious payloads within the security context of the hosting page.
From a technical perspective, this flaw is categorized under CWE-79, which defines Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The specific mechanism involves the failure to escape special characters that have meaning in HTML or JavaScript contexts before insertion into the DOM structure. By writing language strings directly as markup, the library bypasses standard text-node creation methods that would inherently neutralize script execution vectors. This allows for the injection of elements such as img tags with onerror handlers, svg tags with onload events, or direct script injections depending on the surrounding context and browser parsing rules. The vulnerability is particularly dangerous because it does not require complex social engineering or specific user interactions beyond the initial page load where the chart renders.
The operational impact of this vulnerability is significant for any web application utilizing Highcharts to display data-driven grids with pagination features enabled. An attacker can exploit this flaw to perform session hijacking by stealing cookies and authentication tokens, deface the website content, redirect users to malicious sites, or execute arbitrary actions on behalf of authenticated users. Since exploitation does not require additional user interaction beyond visiting a page that renders the vulnerable chart configuration, it qualifies as an auto-executing XSS vector. This lowers the barrier for entry significantly compared to stored or reflected XSS variants that might require clicking links or submitting forms. The attack surface is limited to scenarios where pagination is explicitly enabled in the Highcharts configuration and the language strings are derived from untrusted sources such as URL parameters, database entries, or API responses without proper validation.
Mitigation strategies for this vulnerability primarily involve upgrading to version 3.2.0 of Highcharts JS, which contains the official patch that corrects the DOM injection behavior by ensuring all input is treated strictly as text data rather than markup. For organizations unable to immediately upgrade their library versions due to compatibility constraints or deployment cycles, a temporary workaround involves implementing strict server-side validation and sanitization of any language configuration strings before they are passed to the client-side JavaScript code. Developers should ensure that only alphanumeric characters and standard punctuation allowed for pagination labels are accepted, rejecting or escaping all other special HTML entities such as angle brackets, quotes, ampersands, and semicolons. Additionally, implementing Content Security Policy headers can help mitigate the impact of successful exploitation by restricting the sources from which scripts can be loaded and executed, thereby reducing the effectiveness of injected payloads even if they bypass input validation controls.
This vulnerability aligns with MITRE ATT&CK technique T1059.007, JavaScript Execution, specifically within a web browser environment. It also relates to CWE-20 Improper Input Validation as the root cause lies in the failure to validate and sanitize configuration inputs before processing them for display. The incident underscores the critical importance of treating all dynamic content injected into HTML structures with extreme caution, regardless of whether it originates from internal configuration objects or external user input. Secure coding practices dictate that data intended for display must always be encoded appropriately for its context, ensuring that browsers interpret it as text rather than executable code structure.