CVE-2026-118252

    Dashboard / Vulnerabilities / CVE-2026-118252

    CVE-2026-118252

    Published: 28 Oct 2026Last Modified: 1 Nov 2026

    Summary: Highcharts Dashboards: sidebar component labels are parsed as HTML

    Details: Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing event handlers, which execute in the hosting page origin when a user opens the edit-mode sidebar and the affected labels render. This issue is fixed in 4.2.3.

    References: https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.3, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118252.json, https://github.com/highcharts/highcharts/security/advisories/GHSA-rcqf-f6h2-ccg9, https://nvd.nist.gov/vuln/detail/CVE-2026-118252, https://github.com/highcharts/highcharts/commit/e65f8c21b9974dcccfa1c600a375d836acef4a7d

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -283f2c015f0e2830d7eb53714ce894efc227b1c7

    Affected versions

    v13.0.0
    v13.0.2
    v13.0.1
    v13.0.0-beta.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118252 | CVE-DB