Zero Radar
← feed
HighVulnerabilityCVE-2026-118254updated 28 Oct 2026, 19:58 UTC

Highcharts Grid lets injected code run in pages showing paginated tables

If an attacker can change the text used for table pagination labels, their code can run in the browser of anyone viewing that table. Upgrading the library closes this.

Fix availableOfficial, 2 sources
SeverityHighCVSS 8.6 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes@highcharts/grid-lite 3.2.0 and @highcharts/grid-pro 3.2.0 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Attacker supplies language textPagination label contains markup with event handler
  2. 2Grid renders paginationText is written into the DOM as HTML
  3. 3Handler runs in pageScript executes in the hosting page origin
  4. 4Page data exposedAttacker code acts with the page's privileges
  5. ResultAttacker runs script in the page

What happened

Highcharts Grid (grid-lite and grid-pro) writes pagination language strings into the DOM as HTML markup instead of plain text, so elements with event handlers can be injected and executed in the hosting page origin when pagination controls render.

Why it is dangerous: An attacker who can influence the Grid language configuration can run script in the origin of the hosting page, potentially reading or acting on user data in that site. Exploitation requires pagination to be enabled but no extra user interaction.

Are you affected?

You are affected if you use @highcharts/grid-lite or @highcharts/grid-pro versions 2.0.0 through 3.1.0 with pagination enabled and untrusted data can reach the Grid language configuration.

Package / productAffected versionsFixed in
@highcharts/grid-lite · npm>= 2.0.0, <= 3.1.03.2.0
@highcharts/grid-pro · npm>= 2.0.0, <= 3.1.03.2.0

What to do

  1. Update @highcharts/grid-lite and @highcharts/grid-pro to 3.2.0 (e.g. npm install @highcharts/grid-lite@3.2.0)
  2. If loading from a CDN, switch to a versioned URL for 3.2.0
  3. If you cannot upgrade yet, apply the escaping workaround from the advisory before creating any grid

Timeline

  1. 28 Oct 2026, 19:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 19:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 19:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 19:58 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 19:58 UTC
    Fixed version published: @highcharts/grid-lite 3.2.0, @highcharts/grid-pro 3.2.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118254 · GHSA-r5wg-q8fc-p6w2
CVSS
8.6 / 10
Disclosed
28 Oct 2026, 19:17 UTC
On Zero Radar
28 Oct 2026, 19:17 UTC (0 min after disclosure)
Last change
28 Oct 2026, 19:58 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Highcharts Grid lets injected code run in pages showing paginated tables · Zero Radar