CVE-2026-118245: Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes. Markup and event handlers can then execute in the hosting page origin when the board renders. No user interaction beyond rendering the board is required. This issue is fixed in 4.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Highcharts Dashboardsto a version that resolves this vulnerability.Fixed in 4.2.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Deployments using Highcharts Dashboards versions before 4.2.2 are exposed when an attacker can control dashboard configuration. The issue affects the hosting page origin when the board renders.
What does an attacker need to exploit it?
The attacker needs control over dashboard configuration so they can choose a public Highcharts utility function through chartConstructor and supply chart options. No additional user interaction is required after the board renders.
Are default deployments affected?
The provided information identifies attacker control of dashboard configuration as the required condition. It does not establish that a deployment is exploitable when dashboard configuration is not attacker-controlled.
How can this be remediated?
Upgrade Highcharts Dashboards to version 4.2.2, which fixes the issue. If upgrading cannot happen immediately, prevent untrusted parties from controlling dashboard configuration.