CVE-2026-118242: falha de alta gravidade em highcharts
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
Publicada em
21Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackcvss 8.5epss 0.3%
probabilidade de exploração
0.3%top 77% das CVEs
exploração observada
nãonenhuma fonte reporta
Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
CVEs relacionadas — highcharts
No mesmo produto, das mais perigosas para as menos.
CVE-2021-29489HIGHOptions structure open to XSS if passed unfilteredEPSS 0.9%CVE-2026-118251HIGHHighcharts: javascript: URL in credits.href runs script on clickEPSS 0.4%CVE-2026-118254HIGHHighcharts Grid: pagination language options are parsed as HTMLEPSS 0.4%CVE-2026-118253HIGHHighcharts Dashboards: fullscreen labels are parsed as HTMLEPSS 0.4%CVE-2026-118252HIGHHighcharts Dashboards: sidebar component labels are parsed as HTMLEPSS 0.4%CVE-2026-118250HIGHHighcharts: dotted series.keys paths write to Object.prototypeEPSS 0.4%