Highcharts Grid Pro EUVD-2026-112281

Exploitation requires that attacker-influenced/untrusted data reach the Grid column configuration - specifically an event-handler-named entry (e.g. onmouseover, onfocus) placed in a column's cells.renderer.attributes (view renderer, applied to the input in every rendered row) or cells.editMode.renderer.attributes (applied to the input created when a cell enters edit mode, which is focused immediately so an onfocus handler fires on edit start). A victim must then interact: hover over or focus one of the rendered inputs, or begin editing a cell (matching UI:P). This affects @highcharts/grid-pro 2.0.0-3.1.0 and the Pro DataGrid shipped in @highcharts/dashboards 3.6.0. Limiting factors: the attacker cannot exploit this unless they can influence the column/renderer configuration, and no script runs without user interaction with the affected input. If the column configuration comes only from fully trusted sources, the flaw is not reachable. The vendor provides a scrubbing workaround (an allowlist filter hooked into loadUserOptions/updateColumn), but upgrading to the fixed version is the complete fix.

This is a DOM/stored cross-site-scripting flaw (CWE-79) in Highcharts Grid Pro cell renderers, where event-handler attributes in a column's cells.renderer.attributes or cells.editMode.renderer.attributes map are written verbatim to input/select elements via raw setAttribute, executing in the hosting page's origin. The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L) scores 8.5 (High): network reachable, low complexity, but gated by PR:L (the attacker must be able to influence the Grid column configuration) and UI:P (a user must hover, focus, or begin editing an input). No EPSS score and no KEV listing were provided, so there is no signal of mass or active exploitation; status is no public exploit confirmed as weaponized, though the fix commit itself ships a test harness demonstrating the exact onmouseover/onfocus payloads. The vuln.today priority is 'this_week' rather than act_now/emergency, which is consistent with a high-impact but interaction- and configuration-gated client-side issue rather than a wormable server flaw. Net: a genuine high-severity XSS worth patching promptly for anyone feeding untrusted data into Grid column configuration, but not evidence of a widespread in-the-wild campaign; the real risk hinges entirely on whether attacker-influenced data can reach the Grid config, which the generic CVSS score does not capture.

An application renders a Highcharts Grid Pro / Dashboards grid whose column configuration is derived from untrusted input (for example a shared dashboard definition or user-supplied column metadata). An attacker sets an event-handler attribute such as onmouseover or onfocus in cells.renderer.attributes, so that when a victim user hovers over, focuses, or begins editing the affected input, attacker-controlled JavaScript runs in the hosting page's origin. The patch commit includes a test spec reproducing this with onmouseover and onfocus handlers, i.e. a public PoC reference exists but is not verified as a packaged working exploit.