Highcharts Dashboards CVE-2026-118245

Requires that untrusted data reach the Highcharts Dashboards component configuration and specifically control the chartConstructor property (and the accompanying chartOptions) of a HighchartsComponent. The flaw is in versions >=1.0.0 up to and including 4.2.1 (fixed in 4.2.2); it triggers automatically when the board renders, with no user interaction beyond rendering. What LIMITS exploitation: the attacker must be able to influence the board/dashboard configuration (hence PR:L - not fully unauthenticated against an untouched default), so deployments where dashboard configs are entirely developer-controlled and never carry user/tenant-supplied data are not exposed. The vendor provides a drop-in createChart override restricting chartConstructor to chart/stockChart/mapChart/ganttChart as a workaround, but states upgrading (npm @highcharts/dashboards@4.2.3 or a versioned CDN URL) is the fix.

This is a genuine priority within its deployment scope but not a drop-everything emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity XSS (CWE-79) that needs some privilege (PR:L) - consistent with the advisory's requirement that the attacker control, or inject untrusted data into, the Dashboards component configuration. No user interaction beyond rendering the board is required (UI:N), which raises practical exploitability wherever config content crosses a trust boundary. The vuln.today decision label is 'this_week' (not act_now/emergency), aligning with a serious-but-scheduled posture. KEV status is NO (not listed by CISA), and no EPSS score was provided, so exploitation probability cannot be quantified from the input. No public exploit identified at time of analysis - the references are a vendor GHSA advisory, the fix commit, and a release tag, not working exploit code. Net: the severity is real (script execution in the hosting page origin), but the PR:L precondition and absence of KEV/known exploitation make this a targeted, config-dependent risk rather than mass-exploitable; prioritize patching for any deployment where dashboard configuration can carry untrusted data.

An application renders a Highcharts Dashboard whose configuration is partly derived from untrusted input (e.g., a user-supplied or multi-tenant board definition). The attacker sets chartConstructor to a non-constructor public Highcharts utility function so their chartOptions are copied onto the container element as attributes/markup, and event handlers execute in the hosting page's origin as soon as the board renders. No public exploit code was identified, but the mechanism is fully documented in the vendor GHSA advisory.