Grid Lite
Monthly
DOM-based cross-site scripting in Highcharts Grid (@highcharts/grid-lite and @highcharts/grid-pro) versions 2.0.0 through 3.1.0 allows an attacker who controls the Grid pagination language configuration to inject markup carrying event handlers, which then execute in the origin of the page hosting the Grid when the pagination controls render. No additional user interaction is required once untrusted data reaches the language options and pagination is enabled; the class of impact is script execution in the host page's origin, which the independent assessment scores as scope-changed partial confidentiality and integrity impact with no availability effect. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the vendor advisory, fix commit and workaround are all publicly available, and the vulnerability is prioritised as 'this_week' by vuln.today.
Event-handler attribute injection in Highcharts Grid's custom SVG icon definitions (npm packages @highcharts/grid-lite and @highcharts/grid-pro, versions 2.3.0 through 3.1.0) allows an attacker who can influence Grid configuration to execute script in the origin of the page hosting the grid. The flaw lets icon-definition child keys such as onmouseover or onload be written directly onto generated <path> elements; because custom icons override built-ins, the attacker can replace the default column-sort icon shown in every header or the pagination controls without naming a custom icon, and the payload fires when a user hovers over or activates the icon. Exploitation requires that untrusted data actually reach rendering.icons and that a victim interact with the affected icon, so grids with fully static developer-controlled configuration are not exposed; no public exploit identified at time of analysis.
DOM-based cross-site scripting in Highcharts Grid (@highcharts/grid-lite and @highcharts/grid-pro) versions 2.0.0 through 3.1.0 allows an attacker who controls the Grid pagination language configuration to inject markup carrying event handlers, which then execute in the origin of the page hosting the Grid when the pagination controls render. No additional user interaction is required once untrusted data reaches the language options and pagination is enabled; the class of impact is script execution in the host page's origin, which the independent assessment scores as scope-changed partial confidentiality and integrity impact with no availability effect. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the vendor advisory, fix commit and workaround are all publicly available, and the vulnerability is prioritised as 'this_week' by vuln.today.
Event-handler attribute injection in Highcharts Grid's custom SVG icon definitions (npm packages @highcharts/grid-lite and @highcharts/grid-pro, versions 2.3.0 through 3.1.0) allows an attacker who can influence Grid configuration to execute script in the origin of the page hosting the grid. The flaw lets icon-definition child keys such as onmouseover or onload be written directly onto generated <path> elements; because custom icons override built-ins, the attacker can replace the default column-sort icon shown in every header or the pagination controls without naming a custom icon, and the payload fires when a user hovers over or activates the icon. Exploitation requires that untrusted data actually reach rendering.icons and that a victim interact with the affected icon, so grids with fully static developer-controlled configuration are not exposed; no public exploit identified at time of analysis.