Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-118242— Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Quick assessment

Affected
highcharts highcharts
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Highcharts JS 是一个基于 SVG 的 JavaScript 图表库。在版本 2.3.0 至 3.2.0 期间，Highcharts Grid 会根据 rendering.icons 对象定义创建 SVG 路径元素，并曾通过 setAttribute 方法复制每一个子键。若攻击者能够控制 Grid 配置，便可在图标定义中提供事件处理程序属性名。由于自定义图标会覆盖内置图标，攻击者可替换默认的排序或分页图标；当用户将鼠标悬停于或激活受影响的图标时，恶意脚本将在宿主页面所属的源（origin）中执行。该问题

CVSS 8.5 · High

Affected Version Matrix 3

VendorProduct Version RangeStatus
@highcharts grid-lite >= 2.3.0, < 3.2.0 affected
@highcharts grid-pro >= 2.3.0, < 3.2.0 affected
highcharts highcharts < 13.1.0 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-118242

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
Source: CVE Program / CVE List V5
Vulnerability Description
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
highcharts highcharts < 13.1.0 -
@highcharts grid-lite >= 2.3.0, < 3.2.0 -
@highcharts grid-pro >= 2.3.0, < 3.2.0 -

II. Public POCs for CVE-2026-118242

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-118242

请登录查看更多情报信息。

Other References for CVE-2026-118242 (2)

Same Patch Batch · highcharts · 2026-10-28 · 16 CVEs total

CVE-2026-118245 8.6 HIGH Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts names
CVE-2026-118254 8.6 HIGH Highcharts Grid: pagination language options are parsed as HTML
CVE-2026-116797 8.5 HIGH Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
CVE-2026-118246 8.4 HIGH Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
CVE-2026-118253 8.4 HIGH Highcharts Dashboards: fullscreen labels are parsed as HTML
CVE-2026-118251 8.4 HIGH Highcharts: javascript: URL in credits.href runs script on click
CVE-2026-118252 8.4 HIGH Highcharts Dashboards: sidebar component labels are parsed as HTML
CVE-2026-118255 8.4 HIGH Highcharts Grid: javascript: URL in credits.href runs script on click
CVE-2026-116796 7.2 HIGH Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering an
CVE-2026-118244 7.2 HIGH Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during
CVE-2026-118250 7.2 HIGH Highcharts: dotted series.keys paths write to Object.prototype
CVE-2026-118249 7.2 HIGH Highcharts: series column construction writes to Object.prototype
CVE-2026-118247 6.9 MEDIUM Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__`
CVE-2026-118248 6.9 MEDIUM Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
CVE-2026-118243 5.3 MEDIUM Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototyp

IV. Related Vulnerabilities

Same product: highcharts
Same vendor: highcharts
Same weakness: CWE-79