JavaScript Library Vulnerability in Highcharts Grid Affects Multiple Versions
CVE-2026-118255
8.4HIGH
What is CVE-2026-118255?
Highcharts Grid, a widely used JavaScript charting library, has a vulnerability that arises from improper validation of the URL scheme associated with credits links in versions 2.0.0 to 3.2.0. This flaw allows an attacker to manipulate the Grid configuration to inject a malicious JavaScript URL. If a user activates the credits link, it can result in the execution of arbitrary scripts within the context of the hosting page, potentially exposing sensitive application data and session information. This vulnerability has been addressed in Grid Pro version 3.2.0.
Affected Version(s)
dashboards >= 3.2.0, < 4.0.0
grid-pro >= 2.0.0, < 3.2.0
highcharts < 13.0.0-beta.2