CVE-2026-118254: Highcharts Grid: pagination language options are parsed as HTML
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Highcharts Gridto a version that resolves this vulnerability.Fixed in 3.2.0
Event History
Frequently Asked Questions
Which deployments are exposed to this issue?
Highcharts Grid versions from 2.0.0 up to, but not including, 3.2.0 are affected when pagination is enabled. Deployments that do not enable pagination do not meet the stated exploitation condition.
What level of attacker control is required?
An attacker must be able to control Grid language configuration values used for pagination. No additional user interaction is required once the pagination controls render.
What can be done if an immediate upgrade is not possible?
Disable pagination to remove the stated condition required for exploitation, and ensure untrusted parties cannot control Grid language configuration strings. Upgrade to Highcharts Grid 3.2.0 when possible.