Exposure of Highcharts

JavaScript graphics

47

exposure score

12,809

sites use

0

exploited

0

critical

CVEs

17 results

CVE-2021-29489HIGHOptions structure open to XSS if passed unfilteredEPSS 0.9%CVE-2026-118251HIGHHighcharts: javascript: URL in credits.href runs script on clickEPSS 0.4%CVE-2026-118254HIGHHighcharts Grid: pagination language options are parsed as HTMLEPSS 0.4%CVE-2026-118252HIGHHighcharts Dashboards: sidebar component labels are parsed as HTMLEPSS 0.4%CVE-2026-118253HIGHHighcharts Dashboards: fullscreen labels are parsed as HTMLEPSS 0.4%CVE-2026-118250HIGHHighcharts: dotted series.keys paths write to Object.prototypeEPSS 0.4%CVE-2026-118249HIGHHighcharts: series column construction writes to Object.prototypeEPSS 0.4%CVE-2026-118247MEDIUMHighcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.EPSS 0.4%CVE-2026-118243MEDIUMHighcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`EPSS 0.4%CVE-2026-118255HIGHHighcharts Grid: javascript: URL in credits.href runs script on clickEPSS 0.3%CVE-2026-118245HIGHHighcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespaceEPSS 0.3%CVE-2026-118246HIGHHighcharts Core: `breadcrumbs.style` keys become SVG event-handler attributesEPSS 0.3%CVE-2026-116796HIGHHighcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported chartsEPSS 0.3%CVE-2026-118244HIGHHighcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during printEPSS 0.3%CVE-2026-116797HIGHHighcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`EPSS 0.3%CVE-2026-118242HIGHHighcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`EPSS 0.3%CVE-2026-118248MEDIUMHighcharts Dashboards: editableOptions.propertyPath writes to Object.prototypeEPSS 0.3%