Highcharts vulnerabilities

Products

• Highcharts 18

Newest

• highcharts, @highcharts dashboards, grid-pro +2 more Highcharts Grid: javascript: URL in credits.href runs script on click CVE-2026-118255 Fix available 8.4 HighOctober 28, 2026
• highcharts, @highcharts grid-lite, grid-pro +2 more Highcharts Grid: pagination language options are parsed as HTML CVE-2026-118254 Fix available 8.6 HighOctober 28, 2026
• @highcharts dashboards, highcharts +1 more Highcharts Dashboards: fullscreen labels are parsed as HTML CVE-2026-118253 Fix available 8.4 HighOctober 28, 2026
• @highcharts dashboards, highcharts +1 more Highcharts Dashboards: sidebar component labels are parsed as HTML CVE-2026-118252 Fix available 8.4 HighOctober 28, 2026
• highcharts Highcharts: javascript: URL in credits.href runs script on click CVE-2026-118251 Fix available 8.4 HighOctober 28, 2026
• highcharts Highcharts: dotted series.keys paths write to Object.prototype CVE-2026-118250 Fix available 7.2 HighOctober 28, 2026
• highcharts Highcharts: series column construction writes to Object.prototype CVE-2026-118249 Fix available 7.2 HighOctober 28, 2026
• @highcharts dashboards, highcharts +1 more Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype CVE-2026-118248 6.9 MediumOctober 28, 2026
• @highcharts dashboards, highcharts, @highcharts grid-pro +2 more Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. CVE-2026-118247 Fix available 6.9 MediumOctober 28, 2026
• highcharts Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes CVE-2026-118246 Fix available 8.4 HighOctober 28, 2026
• @highcharts dashboards, highcharts +1 more Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace CVE-2026-118245 Fix available 8.6 HighOctober 28, 2026
• highcharts Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print CVE-2026-118244 Fix available 7.2 HighOctober 28, 2026
• highcharts Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` CVE-2026-118243 Fix available 5.3 MediumOctober 28, 2026
• highcharts, @highcharts grid-lite, grid-pro +2 more Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>` CVE-2026-118242 Fix available 8.5 HighOctober 28, 2026
• highcharts, @highcharts dashboards, grid-pro +2 more Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` CVE-2026-116797 Fix available 8.5 HighOctober 28, 2026
• highcharts Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts CVE-2026-116796 Fix available 7.2 HighOctober 28, 2026
• highcharts, netapp cloud backup, oncommand insight +2 more +4 more Options structure open to XSS if passed unfiltered CVE-2021-29489 Fix available 7.6 HighApril 3, 2020
• highcharts Regular Expression Denial of Service in Acorn CVE-2018-20801 Fix available 7.5 HighMarch 14, 2019