CVE-2026-116797 with a CVSS score of 8.5 is a cross-site scripting flaw in Highcharts Grid Pro input-type cell renderers, where the attributes map is copied onto created input or select elements using raw setAttribute without validating attribute names. The affected versions are @highcharts/grid-pro (npm) versions >= 2.0.0, <= 3.1.0 and @highcharts/dashboards (npm) versions = 3.6.0. An attacker who can influence Grid configuration can place event-handler attributes under a column's cells.renderer.attributes or cells.editMode.renderer.attributes. When the Grid renders, a view renderer can attach the handler to inputs in every row of the column, while an edit-mode renderer can attach it to the input created when a cell enters edit mode, with that input focused immediately so a focus handler can run. Exploitation requires untrusted data to reach the Grid configuration and a user to hover over or focus one of the rendered inputs, or begin editing a cell. The resulting script execution in the page origin can allow attackers to perform actions as the user, access sensitive data, manipulate the application, or compromise business workflows that rely on the Grid.
The following reports contain further technical details:[/subscribe_to_unlock_form]
CVE-2026-116797 with a CVSS score of 8.5 is a cross-site scripting flaw in Highcharts Grid Pro input-type cell renderers, where the attributes map is copied onto created input or select elements using raw setAttribute without validating attribute names. The affected versions are @highcharts/grid-pro (npm) versions >= 2.0.0, <= 3.1.0 and @highcharts/dashboards (npm) versions = 3.6.0. An attacker who can influence Grid configuration can place event-handler attributes under a column's cells.renderer.attributes or cells.editMode.renderer.attributes. When the Grid renders, a view renderer can attach the handler to inputs in every row of the column, while an edit-mode renderer can attach it to the input created when a cell enters edit mode, with that input focused immediately so a focus handler can run. Exploitation requires untrusted data to reach the Grid configuration and a user to hover over or focus one of the rendered inputs, or begin editing a cell. The resulting script execution in the page origin can allow attackers to perform actions as the user, access sensitive data, manipulate the application, or compromise business workflows that rely on the Grid.
The following reports contain further technical details:[emaillocker id="1283"]
[/emaillocker]