CVE-2026-118255 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state.This issue is fixed in Grid Pro 3.2.0.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified involves Highcharts JS, specifically affecting versions from 2.0.0 through 3.2.0 when utilizing the Grid component. This JavaScript library relies on SVG for rendering charts and includes a feature that displays credits or attribution links within the generated visualizations. The core technical flaw lies in how the application handles the href attribute of these credit links. During this period, the implementation failed to validate the URL scheme provided by the developer configuring the grid. Consequently, if an attacker gains control over the Grid configuration data, they can inject a malicious javascript: URI into the credits.href property instead of a standard http or https link.
When a user interacts with the chart and clicks on the credits link, the browser interprets the injected javascript: scheme as executable code rather than a navigation target. This results in the execution of arbitrary JavaScript within the context of the hosting page's origin. Because the script runs in the same security domain as the main application, it inherits full access to that environment's sensitive assets. This includes direct read and write access to session cookies, local storage data, DOM elements containing confidential information, and other stateful variables maintained by the web application. The impact is severe because it effectively bypasses Same-Origin Policy protections intended to isolate different sources of content, allowing for complete compromise of user sessions and potential exfiltration of sensitive business or personal data.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). More specifically, it represents an Unrestricted URL Scheme issue where the application trusts user-supplied input for critical security controls like link destinations without sanitizing or validating the protocol. In terms of offensive cyber operations and threat modeling, this behavior maps to ATT&CK technique T1059, Command and Scripting Interpreter, as well as T1204, User Execution, since it requires a user action (clicking the link) to trigger the malicious payload. The attack vector is primarily remote if the configuration data can be manipulated by an external actor or local if the attacker has access to modify client-side settings before deployment.
The operational impact extends beyond simple script execution. An adversary leveraging this flaw could perform session hijacking by stealing authentication tokens, conduct phishing attacks by manipulating page content dynamically, or deface the application interface. In enterprise environments where Highcharts is used for dashboards displaying real-time metrics or financial data, such a breach undermines trust in the integrity of the displayed information and exposes underlying database queries if they are accessible via client-side APIs triggered by the injected script.
This issue was addressed in Grid Pro version 3.2.0 through improved input validation mechanisms that restrict allowed URL schemes to safe protocols like http, https, ftp, or mailto, while explicitly blocking javascript: and data: URIs unless strictly necessary for specific non-interactive contexts which are typically handled differently. For organizations still running affected versions, immediate mitigation involves upgrading the Highcharts library to version 3.2.0 or later where this validation is enforced natively. If an upgrade is not immediately feasible, developers should implement server-side sanitization of any configuration data passed to the client side and ensure that no user-controlled input directly populates attributes like href without rigorous scheme checking using a whitelist approach. Additionally, implementing Content Security Policy headers can provide a layer of defense by restricting script execution sources, although this does not replace the need for fixing the underlying validation flaw in the library itself.