Highcharts Grid Pro CVE-2026-118255

Two concrete prerequisites must both hold: (1) attacker-controlled or untrusted data must reach the Grid configuration so that credits.href can be set to a javascript: scheme URL (default vendor-supplied credits.href is a benign Highcharts link, so this requires an application that lets untrusted input influence Grid config), and (2) a user must actively activate/click the credits link (UI:A in the CVSS vector) for the script to run. Exploitation is limited by this required user interaction and by the need for config injection - it is not triggerable purely remotely against a default, static configuration. Affected: Grid Pro 2.0.0 through 3.1.0 and @highcharts/dashboards 3.2.0 through 3.6.0. The only complete fix per the vendor is upgrading to Grid Pro 3.2.0 (or dashboards 4.0.0); the advisory also provides a loadUserOptions monkey-patch workaround using AST.filterUserAttributes to sanitize credits.href before a Grid is created.

This is a CWE-79 DOM/stored XSS in Highcharts Grid where credits.href is applied without scheme validation, allowing a javascript: URL to execute in the hosting page's origin. The supplied CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N, 8.4) indicates a network vector with low attacker privilege but mandatory active user interaction (a user must click the credits link), which materially dampens real-world exploitability. The vuln.today decision label is this_week, indicating elevated but not emergency urgency. No KEV listing is present and no EPSS probability was supplied, so there is no signal of active or widespread exploitation; the only references are the vendor advisory, the fixing pull request, and the fix commit/release - i.e. patch artifacts, not weaponized exploit code. Two signals are in tension: the high 8.4 base score (driven by high confidentiality/integrity impact and privilege-origin script execution) versus the real-world constraints that the attacker must already control untrusted data flowing into the Grid configuration AND a victim must activate the credits link. Net: a genuine, patch-worthy XSS affecting applications that feed untrusted input into Grid config, but not a drop-everything mass-exploitation threat absent any KEV/EPSS evidence - prioritize for this week's patch cycle as the decision label suggests.

An application renders a Highcharts Grid using configuration partly derived from untrusted input (e.g. a user- or tenant-supplied dashboard definition). The attacker sets credits.href to a javascript: URL; when a victim viewing the page clicks the Highcharts credits link, attacker script runs in the application's origin with access to its data, storage, and session state. No public working exploit code is referenced - only the vendor advisory, fixing PR, and patch commit.