Highcharts Dashboards CVE-2026-118252

Two concrete prerequisites must both hold: (1) untrusted data must reach the Highcharts Dashboards language configuration (the edit-mode sidebar component language strings, this.lang.sidebar), giving the attacker control over those label strings; and (2) a user must actively open the edit-mode sidebar so the affected labels render, at which point they are parsed as HTML instead of inserted as text. Limiting factors: exploitation is impossible if Edit Mode is disabled (editMode.enabled: false), and it requires the privilege to influence the language config (PR:L) plus victim interaction (UI:A), so it is not a default-config, zero-interaction remote XSS. Affected versions are @highcharts/dashboards 1.0.0 through 4.2.2; 4.2.3 renders the labels as text and removes the exposure.

Signals are moderate and internally consistent rather than alarming. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N, 8.4) describes a network-reachable, low-complexity stored XSS, but two metrics materially gate it: PR:L means the attacker must already be able to influence the Dashboards language configuration (untrusted data must reach that config), and UI:A means a legitimate user must actively open the edit-mode sidebar before the payload fires. The vuln.today decision label is 'this_week' (not act_now/emergency), which fits a real-but-not-urgent priority. No EPSS score, no CISA KEV listing, and no SSVC fields were supplied, so exploitation probability and automatability cannot be quantified from this input. The references are the GHSA advisory, the fix commit, and the 4.2.3 release - i.e. fix artifacts, not exploit code - so there is no public exploit identified at time of analysis. Net: this is a legitimate high-severity XSS whose real-world risk is tempered by the requirement that an attacker first get markup into the language configuration and that an operator open edit mode; it warrants prompt patching but the preconditions make opportunistic mass exploitation unlikely.

An attacker who can influence the Dashboards language/localization configuration (for example via a multi-tenant or user-supplied localization pipeline) plants a language string containing an HTML event handler. When a dashboard operator later opens the edit-mode sidebar, the affected component labels are parsed as HTML and the handler executes in the origin of the hosting page, allowing session/DOM access or actions as that user. No public exploit code was provided in the input; only vendor fix references exist.