Zero Radar
← feed
HighVulnerabilityCVE-2026-116797updated 28 Oct 2026, 19:56 UTC

Highcharts Grid Pro lets attacker-controlled column settings run scripts in web pages

If a web page builds its data table from settings an attacker can influence, the attacker can make the table run hidden code in visitors' browsers. Hovering over, clicking, or editing a cell is enough to trigger it.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.5 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes@highcharts/grid-pro 3.2.0; @highcharts/dashboards 4.0.0 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker injects configMalicious column renderer attributes supplied
  2. 2Grid renders inputsAttributes copied to input elements unfiltered
  3. 3User hovers or editsTriggers the injected event handler
  4. 4Script runs in pageExecutes with the site's origin and privileges
  5. ResultAttacker runs script in victim's session

What happened

Highcharts Grid Pro copies cell renderer attributes straight onto input and select elements without filtering names, so event-handler attributes such as onfocus or onmouseover are accepted and executed as script in the hosting page's origin (stored/DOM XSS).

Why it is dangerous: An attacker who can inject column configuration can run JavaScript with the same access as the site, including reading session data and acting as the logged-in user. Sites that build grid configuration from untrusted input are most at risk.

Are you affected?

You are affected if you use @highcharts/grid-pro from 2.0.0 through 3.1.0, or @highcharts/dashboards 3.6.0 (which includes Pro DataGrid), and any part of the column configuration comes from untrusted data.

Package / productAffected versionsFixed in
@highcharts/grid-pro · npm>= 2.0.0, <= 3.1.03.2.0
@highcharts/dashboards · npm= 3.6.04.0.0

What to do

  1. Update @highcharts/grid-pro to 3.2.0 or later (e.g. npm install @highcharts/grid-lite@3.2.0 or the matching grid-pro release).
  2. Update @highcharts/dashboards to 4.0.0 or later.
  3. If you cannot update yet and column configuration comes from outside your control, add the workaround filter from the advisory that strips non-allowlisted renderer attributes.

Timeline

  1. 28 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 18:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 19:56 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 19:56 UTC
    Fixed version published: @highcharts/grid-pro 3.2.0, @highcharts/dashboards 4.0.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-116797 · GHSA-5ghw-9mgr-jvx2
CVSS
8.5 / 10
Disclosed
28 Oct 2026, 18:17 UTC
On Zero Radar
28 Oct 2026, 18:17 UTC (1 min after disclosure)
Last change
28 Oct 2026, 19:56 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Highcharts Grid Pro lets attacker-controlled column settings run scripts in web pages · Zero Radar