HighVulnerabilityCVE-2026-118255updated 28 Oct 2026, 19:58 UTC

Highcharts Grid Pro lets a crafted credits link run attacker code

If a web page shows a chart built from data an attacker can influence, a link in the chart's credits area can run hidden code when clicked. That code can act as the logged-in user of the website.

Fix availableOfficial, 2 sources

Severity	HighCVSS 8.4 of 10
Being exploited?	UnclearNo reports either way yet
Fix available?	Yes@highcharts/dashboards 4.0.0; @highcharts/grid-pro 3.2.0 (per the advisory, grid-lite 3.2.0 is also cited as the patched release) · since 28 Oct 2026
How sure is this?	Official, 2 sourcesBacked by an official source

How the attack works simplified

1Attacker supplies configMalicious credits.href value enters Grid options
2Grid renders credits linkNo scheme check on the href
3User clicks credits linkjavascript: URL is activated
4Script runs in page originSame access as the hosting app
ResultAttacker acts as the logged-in user

What happened

Highcharts Grid applies the credits.href setting to a link without checking the URL scheme, so a javascript: URL is accepted and executes when the link is activated.

Why it is dangerous: Attacker script runs in the origin of the hosting page with access to its data, storage and session state, so a logged-in user's account in that application can be taken over.

Are you affected?

You are affected if you use @highcharts/dashboards 3.2.0 through 3.6.0 or @highcharts/grid-pro 2.0.0 through 3.1.0 and untrusted data can reach the Grid configuration.

Package / product	Affected versions	Fixed in
@highcharts/dashboards · npm	>= 3.2.0, <= 3.6.0	4.0.0
@highcharts/grid-pro · npm	>= 2.0.0, <= 3.1.0	3.2.0

What to do

Update @highcharts/grid-pro to 3.2.0 or later, or @highcharts/dashboards to 4.0.0 or later
If you cannot update yet, add the sanitizing workaround from the GitHub advisory before any Grid is created
Make sure user-supplied data never flows into Grid configuration unchecked

Timeline

28 Oct 2026, 19:17 UTC
Publicly disclosed
28 Oct 2026, 19:17 UTC
Reported by NVD · NVD
28 Oct 2026, 19:17 UTC
Picked up by Zero Radar
28 Oct 2026, 19:58 UTC
GitHub Advisory reported on it · GitHub Advisory
28 Oct 2026, 19:58 UTC
Fixed version published: @highcharts/dashboards 4.0.0, @highcharts/grid-pro 3.2.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

CVE-2026-118255NVD · 28 Oct 2026, 19:17 UTC
Highcharts Grid: `javascript:` URL in credits.href runs script on clickGitHub Advisory · 28 Oct 2026, 19:57 UTC

Technical details

ID: CVE-2026-118255 · GHSA-6hgp-fmhr-mrg4
CVSS: 8.4 / 10
Disclosed: 28 Oct 2026, 19:17 UTC
On Zero Radar: 28 Oct 2026, 19:17 UTC (0 min after disclosure)
Last change: 28 Oct 2026, 19:58 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works