Zero Radar
← feed
HighVulnerabilityCVE-2026-118245updated 28 Oct 2026, 19:56 UTC

Highcharts Dashboards: crafted board config can run attacker scripts on the page

If a dashboard's setup settings can be controlled by someone untrusted, they can make the page run their own code. The victim only needs to open the dashboard.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes@highcharts/dashboards 4.2.2 (also the versioned CDN URL .../dashboards/4.2.2/dashboards.js) · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker edits configSets chartConstructor to a utility function
  2. 2Config reaches dashboardUntrusted data feeds the board setup
  3. 3Board rendersLibrary invokes the chosen function
  4. 4Options copied to pageMarkup and event handlers land in the DOM
  5. ResultAttacker script runs in the hosting page

What happened

Highcharts Dashboards selects a chart constructor from the Highcharts namespace without checking it against an allowlist. An attacker can pick a public utility function instead, which copies attacker-supplied options (including markup and event handlers) onto the container element.

Why it is dangerous: Attacker code runs in the origin of the page hosting the dashboard, so it can access that site's session and data. No user interaction beyond rendering the board is needed.

Are you affected?

You are affected if you use @highcharts/dashboards from 1.0.0 through 4.2.1 and any part of the dashboard configuration comes from data you do not fully control.

Package / productAffected versionsFixed in
@highcharts/dashboards · npm>= 1.0.0, <= 4.2.14.2.2

What to do

  1. Upgrade to @highcharts/dashboards 4.2.2 or later (e.g. npm install @highcharts/dashboards@4.2.2)
  2. If you load from a CDN, switch to the versioned URL for 4.2.2
  3. If you cannot upgrade yet, add the advisory's workaround snippet that restricts chartConstructor to allowed chart types right after importing libraries

Timeline

  1. 28 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 18:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 19:56 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 19:56 UTC
    Fixed version published: @highcharts/dashboards 4.2.2 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118245 · GHSA-grj7-r4jv-pw9j
CVSS
8.6 / 10
Disclosed
28 Oct 2026, 18:17 UTC
On Zero Radar
28 Oct 2026, 18:17 UTC (1 min after disclosure)
Last change
28 Oct 2026, 19:56 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Highcharts Dashboards: crafted board config can run attacker scripts on the page · Zero Radar