Highcharts Grid CVE-2026-118242

Two concrete prerequisites must both hold: (1) untrusted data must reach the Grid configuration - specifically the rendering.icons icon-definition objects - so the attacker can supply child entries whose keys name event handlers (e.g. onmouseover, onload); and (2) a user must hover over or activate the affected icon (UI:P). Because custom icons take precedence over built-ins, the default column-sort icon (shown in every column header) or the pagination controls (where pagination is enabled) can be replaced without any reference to a custom icon name. Limiting factors that reduce real-world risk: exploitation is impossible where the Grid configuration is entirely developer-controlled/static and never fed untrusted input (PR:L); it also depends on user interaction with the icon; and it is confined to @highcharts/grid-lite and grid-pro versions 2.3.0 through 3.1.0.

This is a genuine, well-substantiated client-side code-execution (DOM/stored XSS, CWE-79) issue, but its real-world priority is conditional rather than universal. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N, 8.5) and the vuln.today 'this_week' decision label both point to a serious-but-not-emergency posture - notably NOT act_now or emergency. The critical gating signals are PR:L (the attacker must be able to influence the Grid configuration object, i.e. untrusted data must reach rendering.icons) and UI:P (a user must hover over or activate the affected icon). These two conditions sharply narrow the exploitable population versus a raw 8.5 network-vector read. It is not in CISA KEV, so there is no confirmed active exploitation, and no EPSS score was supplied, so widespread-exploitation probability cannot be quantified from the input. A working demonstration of the injection exists in the fix commit's own Playwright test (event-handler attributes onmouseover/onload on a custom icon path), so this is more than theoretical, but that is defensive test code, not a distributed weaponized exploit. Bottom line: treat as a high-severity injection to patch this cycle for any deployment where Grid configuration can be influenced by untrusted input; where configuration is fully developer-controlled and static, real-world risk is materially lower.

An application renders a Highcharts Grid (grid-lite or grid-pro, 2.3.0-3.1.0) whose configuration is partly derived from untrusted input, and an attacker supplies a rendering.icons custom icon definition whose child path entry includes event-handler keys such as onmouseover or onload. Because custom icons override built-ins like the default column-sort icon and pagination controls, the malicious handler is attached with no special icon reference needed, and the attacker's script runs in the hosting page's origin the moment a user hovers over or activates the icon. A demonstration of the injection exists in the fix commit's test suite, but no standalone public exploit is identified.