Highcharts Grid CVE-2026-118254

Two concrete prerequisites, both stated by the vendor: (1) untrusted data must reach the Grid language configuration - specifically the pagination language strings such as pageInfo and pageSizeLabel - and (2) pagination must be enabled on the Grid so the pagination controls actually render. The exploit requires no additional user interaction once those hold. Limiting factors: language options are normally set by the developer rather than exposed to attacker input, so exploitation depends on an application design that pipes untrusted/tenant data into the language config; it only affects @highcharts/grid-lite and @highcharts/grid-pro versions >= 2.0.0 and <= 3.1.0, and the PR:L metric reflects that the attacker must control that configuration. The vendor provides a prototype-patch workaround that escapes '<' in lang.pageInfo and lang.pageSizeLabel, but states that upgrading to 3.2.0 is the fix.

This is a CWE-79 DOM-based XSS in Highcharts Grid where pagination language strings (pageInfo, pageSizeLabel, page-number and ellipsis elements) are written via innerHTML instead of textContent/innerText, confirmed by the GHSA advisory and the fix commit. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, score 8.6) indicates network reach, low complexity, no user interaction, but PR:L - exploitation is NOT fully unauthenticated: an attacker must control the Grid language configuration, which in most deployments is set by the developer rather than exposed to untrusted input. The vuln.today decision label is 'this_week' rather than act_now/emergency. No EPSS score, no CISA KEV listing, and no public exploit were provided in the input, so the three independent exploitation-likelihood signals are all either absent or negative. Net assessment: the headline score is high, but real-world risk is conditional on a non-default data flow (untrusted data reaching the language config) plus pagination being enabled, so for typical deployments where language strings are developer-controlled this is a lower practical priority than the 8.6 suggests; it becomes a genuine priority specifically for applications that populate Grid language options from user- or tenant-supplied data.

An application populates Highcharts Grid pagination language strings (e.g. pageInfo or pageSizeLabel) from untrusted or tenant-supplied data and has pagination enabled. When the pagination controls render, the attacker-supplied markup containing an event handler is parsed as HTML and executes JavaScript in the hosting page's origin, with no additional user interaction required. No public exploit was identified; the issue and its innerHTML sink are documented in the vendor advisory and fix commit.