CVE-2026-118242

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118242", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.312Z", "datePublished": "2026-10-28T17:30:55.383Z", "dateUpdated": "2026-11-03T13:11:25.940Z"}, "containers": {"cna": {"title": "Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "PASSIVE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 8.5, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-6g3c-p4fg-xv47", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-6g3c-p4fg-xv47"}, {"name": "https://github.com/highcharts/highcharts/commit/8fc970658fee6601625b42da29d27c3ef7c45e30", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/commit/8fc970658fee6601625b42da29d27c3ef7c45e30"}], "affected": [{"vendor": "highcharts", "product": "highcharts", "versions": [{"version": "< 13.1.0", "status": "affected"}]}, {"vendor": "@highcharts", "product": "grid-lite", "versions": [{"version": ">= 2.3.0, < 3.2.0", "status": "affected"}]}, {"vendor": "@highcharts", "product": "grid-pro", "versions": [{"version": ">= 2.3.0, < 3.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T17:30:55.383Z"}, "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0."}], "source": {"advisory": "GHSA-6g3c-p4fg-xv47", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T13:10:47.210465Z", "id": "CVE-2026-118242", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:11:25.940Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118242", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T13:10:47.210465Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T13:11:20.361Z"}}], "cna": {"title": "Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`", "source": {"advisory": "GHSA-6g3c-p4fg-xv47", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "highcharts", "product": "highcharts", "versions": [{"status": "affected", "version": "< 13.1.0"}]}, {"vendor": "@highcharts", "product": "grid-lite", "versions": [{"status": "affected", "version": ">= 2.3.0, < 3.2.0"}]}, {"vendor": "@highcharts", "product": "grid-pro", "versions": [{"status": "affected", "version": ">= 2.3.0, < 3.2.0"}]}], "references": [{"url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-6g3c-p4fg-xv47", "name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-6g3c-p4fg-xv47", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/highcharts/highcharts/commit/8fc970658fee6601625b42da29d27c3ef7c45e30", "name": "https://github.com/highcharts/highcharts/commit/8fc970658fee6601625b42da29d27c3ef7c45e30", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T17:30:55.383Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118242", "state": "PUBLISHED", "dateUpdated": "2026-11-03T13:11:25.940Z", "dateReserved": "2026-10-27T20:13:55.312Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T17:30:55.383Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "highcharts", "vendor": "highcharts", "versions": [{"status": "affected", "version": "< 13.1.0"}]}, {"product": "grid-lite", "vendor": "@highcharts", "versions": [{"status": "affected", "version": ">= 2.3.0, < 3.2.0"}]}, {"product": "grid-pro", "vendor": "@highcharts", "versions": [{"status": "affected", "version": ">= 2.3.0, < 3.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0."}], "id": "CVE-2026-118242", "lastModified": "2026-11-03T13:17:20.927", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.5, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "PASSIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118242", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T13:10:47.210465Z", "version": "2.0.3"}}]}, "published": "2026-10-28T18:17:14.963", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/commit/8fc970658fee6601625b42da29d27c3ef7c45e30"}, {"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-6g3c-p4fg-xv47"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "highcharts: highcharts: Cross-site scripting via unsanitized grid icon attributes", "id": "2563053", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563053"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.", "A flaw was found in Highcharts. When rendering grid icons using Scalable Vector Graphics (SVG), the library copies configuration properties directly into element attributes without proper sanitization. An attacker who controls the grid configuration can supply malicious event handlers within custom icon definitions. When a user hovers over or activates an affected icon, arbitrary script executes within their browser session, potentially enabling sensitive information disclosure or unauthorized actions."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."}, "name": "CVE-2026-118242", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Fix deferred", "package_name": "rust-toolset:rhel8/rust", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:enterprise_linux_ai:3", "fix_state": "Fix deferred", "package_name": "rust", "product_name": "Red Hat Enterprise Linux AI (RHEL AI) 3"}], "public_date": "2026-10-28T17:30:55Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118242\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118242\nhttps://github.com/highcharts/highcharts/commit/8fc970658fee6601625b42da29d27c3ef7c45e30\nhttps://github.com/highcharts/highcharts/security/advisories/GHSA-6g3c-p4fg-xv47"], "statement": "This vulnerability is rated as Moderate impact because successful exploitation requires an attacker to inject untrusted configuration objects into Highcharts Grid and relies on user interaction to execute script within the user's browser origin. In standard Red Hat product deployments, chart and grid configurations are not directly exposed to unauthenticated or untrusted input. Consequently, the practical risk is limited to applications where untrusted users can manipulate grid configuration structures without prior server-side sanitization.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.3.0,3.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "grid-lite", "source": "cna", "vendor": "@highcharts"}, "product": "grid-lite", "vendor": "highcharts"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.3.0,3.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "grid-pro", "source": "cna", "vendor": "@highcharts"}, "product": "grid-pro", "vendor": "highcharts"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,13.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "highcharts", "source": "cna", "vendor": "highcharts"}, "product": "highcharts", "vendor": "highcharts"}], "created": "2026-10-28T18:45:07.233091+00:00", "updated": "2026-10-28T21:45:26.243777+00:00", "vendors": ["highcharts", "highcharts$PRODUCT$grid-lite", "highcharts$PRODUCT$grid-pro", "highcharts$PRODUCT$highcharts"]}