Grid Pro
Monthly
A DOM-based cross-site scripting flaw in Highcharts Grid lets an attacker who can influence the Grid configuration set credits.href to a javascript: URL, so clicking the credits link executes attacker script in the hosting page's origin with access to that application's data, storage and session state. Affected are @highcharts/grid-pro 2.0.0 through 3.1.0 and @highcharts/dashboards 3.2.0 through 3.6.0; the vendor fixed Grid Pro in 3.2.0 and Dashboards in 4.0.0. Exploitation requires two conditions to both hold - untrusted data must reach the Grid configuration, and a user must actively click the credits link (the vector rates low privileges, PR:L, and active user interaction, UI:A) - and no public exploit has been identified at time of analysis, though the issue is triaged for remediation this week.
DOM-based cross-site scripting in Highcharts Grid (@highcharts/grid-lite and @highcharts/grid-pro) versions 2.0.0 through 3.1.0 allows an attacker who controls the Grid pagination language configuration to inject markup carrying event handlers, which then execute in the origin of the page hosting the Grid when the pagination controls render. No additional user interaction is required once untrusted data reaches the language options and pagination is enabled; the class of impact is script execution in the host page's origin, which the independent assessment scores as scope-changed partial confidentiality and integrity impact with no availability effect. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the vendor advisory, fix commit and workaround are all publicly available, and the vulnerability is prioritised as 'this_week' by vuln.today.
Event-handler attribute injection in Highcharts Grid's custom SVG icon definitions (npm packages @highcharts/grid-lite and @highcharts/grid-pro, versions 2.3.0 through 3.1.0) allows an attacker who can influence Grid configuration to execute script in the origin of the page hosting the grid. The flaw lets icon-definition child keys such as onmouseover or onload be written directly onto generated <path> elements; because custom icons override built-ins, the attacker can replace the default column-sort icon shown in every header or the pagination controls without naming a custom icon, and the payload fires when a user hovers over or activates the icon. Exploitation requires that untrusted data actually reach rendering.icons and that a victim interact with the affected icon, so grids with fully static developer-controlled configuration are not exposed; no public exploit identified at time of analysis.
Cross-site scripting in Highcharts Grid Pro 2.0.0 through 3.1.0 lets an attacker who can influence column configuration place event-handler attributes into a column's cells.renderer.attributes or cells.editMode.renderer.attributes map, which are copied verbatim onto the input and select elements the grid creates, so script executes in the origin of the page hosting the Grid. A view renderer plants the handler on the input rendered in every row as soon as the grid draws, while an edit-mode renderer plants it on the input created when a cell enters edit mode, which is focused immediately so an onfocus handler fires the moment editing begins. Exploitation requires that untrusted data reach the Grid configuration and that a user hover over or focus a rendered input or start editing a cell; the Pro DataGrid shipped inside @highcharts/dashboards 3.6.0 is also affected. Fixed in Grid Pro 3.2.0 and Dashboards 4.0.0; no public exploit identified at time of analysis, and the flaw is not reachable when column configuration comes only from fully trusted sources.
Prototype pollution in Highcharts Dashboards (1.0.0 through 4.2.1) and Grid Pro (2.0.0 through 3.1.0) lets an attacker who controls a table or component column ID cause DataTable.setCell and related writers to store attacker-supplied values on Object.prototype or the Object constructor under integer (row-index) keys. The unsafe write is reachable by default in Dashboards through the Highcharts component's connector write-back (allowConnectorUpdate), taking the column ID from columnAssignment when a point is updated, and through cell editing and the public DataTable API in Grid Pro; a point update, cell edit, or API write is required, along with user interaction. Successful pollution influences array and object reads and for-in enumeration across the page, which can divert application control flow and disrupt rendering; the assessed impact is low integrity and high availability with no confidentiality impact, rated medium severity (CVSS 4.0 base 6.9, CWE-1321). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available (Dashboards 4.2.2, Grid Pro 3.2.0).
A DOM-based cross-site scripting flaw in Highcharts Grid lets an attacker who can influence the Grid configuration set credits.href to a javascript: URL, so clicking the credits link executes attacker script in the hosting page's origin with access to that application's data, storage and session state. Affected are @highcharts/grid-pro 2.0.0 through 3.1.0 and @highcharts/dashboards 3.2.0 through 3.6.0; the vendor fixed Grid Pro in 3.2.0 and Dashboards in 4.0.0. Exploitation requires two conditions to both hold - untrusted data must reach the Grid configuration, and a user must actively click the credits link (the vector rates low privileges, PR:L, and active user interaction, UI:A) - and no public exploit has been identified at time of analysis, though the issue is triaged for remediation this week.
DOM-based cross-site scripting in Highcharts Grid (@highcharts/grid-lite and @highcharts/grid-pro) versions 2.0.0 through 3.1.0 allows an attacker who controls the Grid pagination language configuration to inject markup carrying event handlers, which then execute in the origin of the page hosting the Grid when the pagination controls render. No additional user interaction is required once untrusted data reaches the language options and pagination is enabled; the class of impact is script execution in the host page's origin, which the independent assessment scores as scope-changed partial confidentiality and integrity impact with no availability effect. There is no CISA KEV listing and no public exploit code identified at time of analysis, though the vendor advisory, fix commit and workaround are all publicly available, and the vulnerability is prioritised as 'this_week' by vuln.today.
Event-handler attribute injection in Highcharts Grid's custom SVG icon definitions (npm packages @highcharts/grid-lite and @highcharts/grid-pro, versions 2.3.0 through 3.1.0) allows an attacker who can influence Grid configuration to execute script in the origin of the page hosting the grid. The flaw lets icon-definition child keys such as onmouseover or onload be written directly onto generated <path> elements; because custom icons override built-ins, the attacker can replace the default column-sort icon shown in every header or the pagination controls without naming a custom icon, and the payload fires when a user hovers over or activates the icon. Exploitation requires that untrusted data actually reach rendering.icons and that a victim interact with the affected icon, so grids with fully static developer-controlled configuration are not exposed; no public exploit identified at time of analysis.
Cross-site scripting in Highcharts Grid Pro 2.0.0 through 3.1.0 lets an attacker who can influence column configuration place event-handler attributes into a column's cells.renderer.attributes or cells.editMode.renderer.attributes map, which are copied verbatim onto the input and select elements the grid creates, so script executes in the origin of the page hosting the Grid. A view renderer plants the handler on the input rendered in every row as soon as the grid draws, while an edit-mode renderer plants it on the input created when a cell enters edit mode, which is focused immediately so an onfocus handler fires the moment editing begins. Exploitation requires that untrusted data reach the Grid configuration and that a user hover over or focus a rendered input or start editing a cell; the Pro DataGrid shipped inside @highcharts/dashboards 3.6.0 is also affected. Fixed in Grid Pro 3.2.0 and Dashboards 4.0.0; no public exploit identified at time of analysis, and the flaw is not reachable when column configuration comes only from fully trusted sources.
Prototype pollution in Highcharts Dashboards (1.0.0 through 4.2.1) and Grid Pro (2.0.0 through 3.1.0) lets an attacker who controls a table or component column ID cause DataTable.setCell and related writers to store attacker-supplied values on Object.prototype or the Object constructor under integer (row-index) keys. The unsafe write is reachable by default in Dashboards through the Highcharts component's connector write-back (allowConnectorUpdate), taking the column ID from columnAssignment when a point is updated, and through cell editing and the public DataTable API in Grid Pro; a point update, cell edit, or API write is required, along with user interaction. Successful pollution influences array and object reads and for-in enumeration across the page, which can divert application control flow and disrupt rendering; the assessed impact is low integrity and high availability with no confidentiality impact, rated medium severity (CVSS 4.0 base 6.9, CWE-1321). No public exploit code and no confirmed active exploitation were identified at time of analysis, and vendor patches are available (Dashboards 4.2.2, Grid Pro 3.2.0).