Cross-Site Scripting in Highcharts Dashboards by Highsoft
CVE-2026-118252
8.4HIGH
What is CVE-2026-118252?
Highcharts Dashboards, a JavaScript charting library developed by Highsoft, contains a vulnerability that arises from improper parsing of component language strings. In versions 1.0.0 through 4.2.3, the edit-mode sidebar processes these strings as HTML instead of plain text. If an attacker can manipulate the Dashboards language configuration, they may inject malicious markup with executable event handlers. This results in Cross-Site Scripting (XSS), allowing the execution of scripts in the context of the affected page when users interact with the edit-mode sidebar. The issue is resolved in version 4.2.3.
Affected Version(s)
dashboards >= 1.0.0, < 4.2.3
highcharts < 13.0.0-beta.2