CVE-2026-118253: Highcharts Dashboards: fullscreen labels are parsed as HTML
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Highcharts Dashboardsto a version that resolves this vulnerability.Fixed in 4.2.3
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Deployments using Highcharts Dashboards versions before 4.2.3 are exposed only where Dashboards edit mode is enabled and viewFullscreen is included in the context-menu items.
What does an attacker need to exploit it?
The attacker must be able to control Dashboards language options. They can then provide HTML markup containing event handlers that execute when the fullscreen control is rendered.
What is the impact of successful exploitation?
Injected event handlers execute in the origin of the page hosting the dashboard, creating a cross-site scripting condition.
How can the issue be remediated?
Upgrade Highcharts Dashboards to version 4.2.3, which fixes the issue.