Dashboards
Monthly
A DOM-based cross-site scripting flaw in Highcharts Grid lets an attacker who can influence the Grid configuration set credits.href to a javascript: URL, so clicking the credits link executes attacker script in the hosting page's origin with access to that application's data, storage and session state. Affected are @highcharts/grid-pro 2.0.0 through 3.1.0 and @highcharts/dashboards 3.2.0 through 3.6.0; the vendor fixed Grid Pro in 3.2.0 and Dashboards in 4.0.0. Exploitation requires two conditions to both hold - untrusted data must reach the Grid configuration, and a user must actively click the credits link (the vector rates low privileges, PR:L, and active user interaction, UI:A) - and no public exploit has been identified at time of analysis, though the issue is triaged for remediation this week.
DOM-based cross-site scripting in Highcharts Dashboards edit mode lets markup placed in the fullscreen language labels execute as script in the hosting page's origin, giving the injected code the same access to page data, storage and session state as the dashboard application itself. The flaw affects the @highcharts/dashboards package from 1.0.0 onward; the vendor advisory states it is fixed in 4.2.3 (the embedded npm package record lists a fix in 4.2.2), and the upstream commit replaces innerHTML with textContent in Fullscreen.setButtonText. Exploitation is constrained: the attacker must control the Dashboards language configuration (PR:L), edit mode must be enabled with viewFullscreen among the context-menu items, and a user must render the control (UI:A), so the trigger surface disappears entirely in deployments that leave edit mode disabled. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis; the priority label is this_week.
Improper neutralization of HTML in the Highcharts Dashboards edit-mode sidebar lets markup supplied through the Dashboards language configuration execute as script in the origin of the page hosting the dashboard. Only deployments running @highcharts/dashboards 1.0.0 through 4.2.2 with Edit Mode enabled are exposed, and the attacker must both control the sidebar language strings (authenticated, PR:L) and persuade a user to open the edit-mode sidebar (UI:R). A public PoC reference is not present in the available data and no public exploit has been identified at time of analysis; fixing to 4.2.3 replaces the HTML sink with text insertion and removes the exposure.
Cross-site scripting in Highcharts Dashboards (npm @highcharts/dashboards) from 1.0.0 through 4.2.1 lets an attacker who can influence dashboard configuration supply an arbitrary chartConstructor value, which the component resolves as an unchecked lookup into the Highcharts namespace and then invokes with the container element and chartOptions; utility members reached this way copy attacker-controlled options onto the container as properties or attributes, so markup and event handlers execute in the origin hosting the page when the board renders, with no user interaction beyond rendering. The CVSS vector requires low-privileged access (PR:L) because the attacker must get untrusted data into the board configuration, and the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) rates confidentiality and integrity impact as low with scope change rather than full compromise, while the CNA score is 8.6. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, but a vendor workaround and a patched release exist and the issue is prioritized as this_week.
Cross-site scripting in Highcharts Grid Pro 2.0.0 through 3.1.0 lets an attacker who can influence column configuration place event-handler attributes into a column's cells.renderer.attributes or cells.editMode.renderer.attributes map, which are copied verbatim onto the input and select elements the grid creates, so script executes in the origin of the page hosting the Grid. A view renderer plants the handler on the input rendered in every row as soon as the grid draws, while an edit-mode renderer plants it on the input created when a cell enters edit mode, which is focused immediately so an onfocus handler fires the moment editing begins. Exploitation requires that untrusted data reach the Grid configuration and that a user hover over or focus a rendered input or start editing a cell; the Pro DataGrid shipped inside @highcharts/dashboards 3.6.0 is also affected. Fixed in Grid Pro 3.2.0 and Dashboards 4.0.0; no public exploit identified at time of analysis, and the flaw is not reachable when column configuration comes only from fully trusted sources.
Prototype pollution in Highcharts Dashboards edit mode lets an attacker who controls a component's editableOptions[].propertyPath write attacker-chosen values onto Object.prototype when a user edits that option in the dashboard, after which the injected property is visible to every script on the page. The flaw affects the @highcharts/dashboards npm package from 1.0.0 through 4.2.1 and is fixed in 4.2.2; exploitation requires the board configuration passed to Dashboards.board() to come from an untrusted source (API, CMS, user-generated content) and requires a low-privileged user to open the component in edit mode and trigger the edit. Impact is application-dependent because the injected property stays inert until other page code reads it, and no public exploit has been identified at time of analysis; the vendor states that updating is the complete fix.
Prototype pollution in Highcharts Dashboards (1.0.0 through 4.2.1) and Grid Pro (2.0.0 through 3.1.0) lets an attacker who controls a table or component column ID cause DataTable.setCell and related writers to store attacker-supplied values on Object.prototype or the Object constructor under integer (row-index) keys. The unsafe write is reachable by default in Dashboards through the Highcharts component's connector write-back (allowConnectorUpdate), taking the column ID from columnAssignment when a point is updated, and through cell editing and the public DataTable API in Grid Pro; a point update, cell edit, or API write is required, along with user interaction. Successful pollution influences array and object reads and for-in enumeration across the page, which can divert application control flow and disrupt rendering; the assessed impact is low integrity and high availability with no confidentiality impact, rated medium severity (CVSS 4.0 base 6.9, CWE-1321). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available (Dashboards 4.2.2, Grid Pro 3.2.0).
A DOM-based cross-site scripting flaw in Highcharts Grid lets an attacker who can influence the Grid configuration set credits.href to a javascript: URL, so clicking the credits link executes attacker script in the hosting page's origin with access to that application's data, storage and session state. Affected are @highcharts/grid-pro 2.0.0 through 3.1.0 and @highcharts/dashboards 3.2.0 through 3.6.0; the vendor fixed Grid Pro in 3.2.0 and Dashboards in 4.0.0. Exploitation requires two conditions to both hold - untrusted data must reach the Grid configuration, and a user must actively click the credits link (the vector rates low privileges, PR:L, and active user interaction, UI:A) - and no public exploit has been identified at time of analysis, though the issue is triaged for remediation this week.
DOM-based cross-site scripting in Highcharts Dashboards edit mode lets markup placed in the fullscreen language labels execute as script in the hosting page's origin, giving the injected code the same access to page data, storage and session state as the dashboard application itself. The flaw affects the @highcharts/dashboards package from 1.0.0 onward; the vendor advisory states it is fixed in 4.2.3 (the embedded npm package record lists a fix in 4.2.2), and the upstream commit replaces innerHTML with textContent in Fullscreen.setButtonText. Exploitation is constrained: the attacker must control the Dashboards language configuration (PR:L), edit mode must be enabled with viewFullscreen among the context-menu items, and a user must render the control (UI:A), so the trigger surface disappears entirely in deployments that leave edit mode disabled. No public exploit code or CISA KEV entry is associated with this CVE at time of analysis; the priority label is this_week.
Improper neutralization of HTML in the Highcharts Dashboards edit-mode sidebar lets markup supplied through the Dashboards language configuration execute as script in the origin of the page hosting the dashboard. Only deployments running @highcharts/dashboards 1.0.0 through 4.2.2 with Edit Mode enabled are exposed, and the attacker must both control the sidebar language strings (authenticated, PR:L) and persuade a user to open the edit-mode sidebar (UI:R). A public PoC reference is not present in the available data and no public exploit has been identified at time of analysis; fixing to 4.2.3 replaces the HTML sink with text insertion and removes the exposure.
Cross-site scripting in Highcharts Dashboards (npm @highcharts/dashboards) from 1.0.0 through 4.2.1 lets an attacker who can influence dashboard configuration supply an arbitrary chartConstructor value, which the component resolves as an unchecked lookup into the Highcharts namespace and then invokes with the container element and chartOptions; utility members reached this way copy attacker-controlled options onto the container as properties or attributes, so markup and event handlers execute in the origin hosting the page when the board renders, with no user interaction beyond rendering. The CVSS vector requires low-privileged access (PR:L) because the attacker must get untrusted data into the board configuration, and the independently assessed vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N) rates confidentiality and integrity impact as low with scope change rather than full compromise, while the CNA score is 8.6. No public exploit code and no CISA KEV entry are associated with this CVE at time of analysis, but a vendor workaround and a patched release exist and the issue is prioritized as this_week.
Cross-site scripting in Highcharts Grid Pro 2.0.0 through 3.1.0 lets an attacker who can influence column configuration place event-handler attributes into a column's cells.renderer.attributes or cells.editMode.renderer.attributes map, which are copied verbatim onto the input and select elements the grid creates, so script executes in the origin of the page hosting the Grid. A view renderer plants the handler on the input rendered in every row as soon as the grid draws, while an edit-mode renderer plants it on the input created when a cell enters edit mode, which is focused immediately so an onfocus handler fires the moment editing begins. Exploitation requires that untrusted data reach the Grid configuration and that a user hover over or focus a rendered input or start editing a cell; the Pro DataGrid shipped inside @highcharts/dashboards 3.6.0 is also affected. Fixed in Grid Pro 3.2.0 and Dashboards 4.0.0; no public exploit identified at time of analysis, and the flaw is not reachable when column configuration comes only from fully trusted sources.
Prototype pollution in Highcharts Dashboards edit mode lets an attacker who controls a component's editableOptions[].propertyPath write attacker-chosen values onto Object.prototype when a user edits that option in the dashboard, after which the injected property is visible to every script on the page. The flaw affects the @highcharts/dashboards npm package from 1.0.0 through 4.2.1 and is fixed in 4.2.2; exploitation requires the board configuration passed to Dashboards.board() to come from an untrusted source (API, CMS, user-generated content) and requires a low-privileged user to open the component in edit mode and trigger the edit. Impact is application-dependent because the injected property stays inert until other page code reads it, and no public exploit has been identified at time of analysis; the vendor states that updating is the complete fix.
Prototype pollution in Highcharts Dashboards (1.0.0 through 4.2.1) and Grid Pro (2.0.0 through 3.1.0) lets an attacker who controls a table or component column ID cause DataTable.setCell and related writers to store attacker-supplied values on Object.prototype or the Object constructor under integer (row-index) keys. The unsafe write is reachable by default in Dashboards through the Highcharts component's connector write-back (allowConnectorUpdate), taking the column ID from columnAssignment when a point is updated, and through cell editing and the public DataTable API in Grid Pro; a point update, cell edit, or API write is required, along with user interaction. Successful pollution influences array and object reads and for-in enumeration across the page, which can divert application control flow and disrupt rendering; the assessed impact is low integrity and high availability with no confidentiality impact, rated medium severity (CVSS 4.0 base 6.9, CWE-1321). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available (Dashboards 4.2.2, Grid Pro 3.2.0).