Multiple vulnerabilities have been identified in Highcharts Grid, affecting the grid-lite and grid-pro packages. The affected components process configuration data in a way that can allow script execution in the origin of the page hosting the grid. The overall risk is significant for deployments that accept grid configuration from untrusted sources.
CVE-2026-118242 (CVSS 8.5 — High): This issue occurs when custom rendering.icons definition objects are rendered by setting unfiltered attribute names on SVG path elements. An attacker who can influence the grid configuration can supply event-handler attributes that execute when an affected icon is rendered or activated.[/subscribe_to_unlock_form]
Multiple vulnerabilities have been identified in Highcharts Grid, affecting the grid-lite and grid-pro packages. The affected components process configuration data in a way that can allow script execution in the origin of the page hosting the grid. The overall risk is significant for deployments that accept grid configuration from untrusted sources.
CVE-2026-118242 (CVSS 8.5 — High): This issue occurs when custom rendering.icons definition objects are rendered by setting unfiltered attribute names on SVG path elements. An attacker who can influence the grid configuration can supply event-handler attributes that execute when an affected icon is rendered or activated.[emaillocker id="1283"]
CVE-2026-118254 (CVSS 8.6 — High): This issue occurs when pagination language strings are inserted into the page as markup rather than as plain text. An attacker who can influence the grid language configuration can supply elements with event handlers that execute when pagination controls are rendered.
We recommend you to update @highcharts/grid-lite and @highcharts/grid-pro to version 3.2.0 or later.
The following reports contain further technical details:
[/emaillocker]