CVE-2026-118252: Highcharts Dashboards: sidebar component labels are parsed as HTML
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing event handlers, which execute in the hosting page origin when a user opens the edit-mode sidebar and the affected labels render. This issue is fixed in 4.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Highcharts Dashboardsto a version that resolves this vulnerability.Fixed in 4.2.3
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Highcharts Dashboards versions from 1.0.0 through 4.2.2 are exposed if an attacker can control the Dashboards language configuration and a user opens the edit-mode sidebar.
What does an attacker need to exploit it?
The attacker needs control over component language strings in the Dashboards language configuration. They can supply HTML markup with event handlers, which executes in the hosting page's origin when the affected sidebar labels render.
Is user interaction required?
Yes. The vulnerable labels render when a user opens the edit-mode sidebar, which triggers execution of attacker-supplied event handlers.
What version fixes the issue?
Highcharts Dashboards 4.2.3 fixes the issue.