Highcharts Dashboards EUVD-2026-112355

Exploitation requires ALL of the following per the GHSA advisory: (1) Dashboards edit mode must be enabled (editMode.enabled: true); (2) the viewFullscreen entry must be present among editMode.contextMenu.items; (3) the attacker must be able to get untrusted data into the Dashboards language configuration (the exitFullscreen/viewFullscreen labels); and (4) the fullscreen control must actually be rendered by a user (UI:A). Limiting factors that reduce realistic risk: the attacker needs privileged control over configuration/language options (PR:L - not an anonymous remote attacker), user interaction is needed to render the control, and the exposure disappears entirely in default/hardened deployments that leave edit mode disabled or omit viewFullscreen from the context menu. Affected versions are from 1.0.0 onward (the vendor states fixed in 4.2.3; note the conflicting package record of fixed in 4.2.2).

This is a DOM-based cross-site scripting flaw (CWE-79) in Highcharts Dashboards edit mode, where fullscreen language labels are inserted via innerHTML instead of textContent. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N) scores 8.4 (High), but the real-world risk is materially constrained by the preconditions rather than the raw score. PR:L indicates the attacker must be authenticated/privileged (they must control the Dashboards language options), and UI:A means the vulnerable control must actually be rendered - the advisory confirms the label is reachable ONLY when edit mode is enabled AND viewFullscreen is present in the context-menu items. No EPSS score was supplied and the CVE is NOT in CISA KEV, so there is no signal of widespread or active exploitation; the vuln.today decision label is 'this_week' (elevated but not emergency), which aligns with a serious-but-gated issue rather than a mass-exploitation event. No working proof-of-concept exploit is present in the input - only the GHSA advisory, the fixing commit, and the release tag. The main conflict in the data concerns the fixed version: the human-readable description and the GHSA summary state the issue is fixed in 4.2.3, while the structured package metadata states vulnerable >= 1.0.0, <= 4.2.1 and fixed in 4.2.2 - this discrepancy must be verified against the vendor release notes before relying on a specific patch floor. Net assessment: a genuine high-impact XSS for anyone who feeds untrusted data into Dashboards language configuration with edit mode active, but not a drop-everything internet-wide emergency given the privilege and configuration gating and the absence of KEV/EPSS/PoC exploitation signals.

An application embeds Highcharts Dashboards with edit mode enabled and viewFullscreen in its context-menu items, and populates the Dashboards language options from a source an attacker can influence (e.g. a tenant-configurable label or a stored setting). The attacker supplies a fullscreen label containing markup with an event handler; when a user opens the context menu and the fullscreen control is rendered, the handler executes in the hosting page origin with full access to page data, storage and session state. No working public exploit is present in the available sources, though the fixing commit (innerHTML → textContent) effectively documents the trigger.