Cross-Site Scripting Vulnerability in Highcharts JS Pagination Handling

CVE-2026-118254

What is CVE-2026-118254?

Highcharts JS is a widely used JavaScript charting library that presents an XSS vulnerability due to improper handling of pagination language strings. In versions 2.0.0 to 3.2.0, the library writes pagination language strings directly into the DOM as markup rather than as text. This opens a vector for attackers controlling the Grid language configuration to insert elements with event handlers. These handlers execute within the context of the hosting page when pagination controls are rendered, allowing unauthorized actions without significant user interaction. This issue has been resolved in version 3.2.0.

References