CVE-2026-118254

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118254", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.313Z", "datePublished": "2026-10-28T18:13:20.084Z", "dateUpdated": "2026-11-03T14:01:46.854Z"}, "containers": {"cna": {"title": "Highcharts Grid: pagination language options are parsed as HTML", "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "lang": "en", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "baseScore": 8.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-r5wg-q8fc-p6w2", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-r5wg-q8fc-p6w2"}, {"name": "https://github.com/highcharts/highcharts/commit/1e8ded84d52191883965641b863cf0c73eb759aa", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/commit/1e8ded84d52191883965641b863cf0c73eb759aa"}, {"name": "https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0"}], "affected": [{"vendor": "highcharts", "product": "highcharts", "versions": [{"version": "< 13.0.0-beta.2", "status": "affected"}]}, {"vendor": "@highcharts", "product": "grid-lite", "versions": [{"version": ">= 2.0.0, < 3.2.0", "status": "affected"}]}, {"vendor": "@highcharts", "product": "grid-pro", "versions": [{"version": ">= 2.0.0, < 3.2.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:13:20.084Z"}, "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0."}], "source": {"advisory": "GHSA-r5wg-q8fc-p6w2", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-11-03T14:01:27.361975Z", "id": "CVE-2026-118254", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T14:01:46.854Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118254", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-11-03T14:01:27.361975Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-11-03T14:01:38.806Z"}}], "cna": {"title": "Highcharts Grid: pagination language options are parsed as HTML", "source": {"advisory": "GHSA-r5wg-q8fc-p6w2", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 8.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "highcharts", "product": "highcharts", "versions": [{"status": "affected", "version": "< 13.0.0-beta.2"}]}, {"vendor": "@highcharts", "product": "grid-lite", "versions": [{"status": "affected", "version": ">= 2.0.0, < 3.2.0"}]}, {"vendor": "@highcharts", "product": "grid-pro", "versions": [{"status": "affected", "version": ">= 2.0.0, < 3.2.0"}]}], "references": [{"url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-r5wg-q8fc-p6w2", "name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-r5wg-q8fc-p6w2", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/highcharts/highcharts/commit/1e8ded84d52191883965641b863cf0c73eb759aa", "name": "https://github.com/highcharts/highcharts/commit/1e8ded84d52191883965641b863cf0c73eb759aa", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0", "name": "https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T18:13:20.084Z"}}}, "cveMetadata": {"cveId": "CVE-2026-118254", "state": "PUBLISHED", "dateUpdated": "2026-11-03T14:01:46.854Z", "dateReserved": "2026-10-27T20:13:55.313Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-10-28T18:13:20.084Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "highcharts", "vendor": "highcharts", "versions": [{"status": "affected", "version": "< 13.0.0-beta.2"}]}, {"product": "grid-lite", "vendor": "@highcharts", "versions": [{"status": "affected", "version": ">= 2.0.0, < 3.2.0"}]}, {"product": "grid-pro", "vendor": "@highcharts", "versions": [{"status": "affected", "version": ">= 2.0.0, < 3.2.0"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0."}], "id": "CVE-2026-118254", "lastModified": "2026-11-03T14:17:25.243", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 8.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118254", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-11-03T14:01:27.361975Z", "version": "2.0.3"}}]}, "published": "2026-10-28T19:17:29.763", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/commit/1e8ded84d52191883965641b863cf0c73eb759aa"}, {"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0"}, {"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-r5wg-q8fc-p6w2"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "grid: Highcharts Grid: Arbitrary script execution via pagination language strings", "id": "2563084", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2563084"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.4", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "status": "draft"}, "cwe": "CWE-79", "details": ["Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.", "A flaw was found in Highcharts Grid. The component renders pagination language strings directly into the Document Object Model (DOM) as markup rather than plain text. An attacker who controls the grid's language configuration can exploit this vulnerability to execute arbitrary scripts in the context of the hosting web page. The issue triggers when pagination controls are rendered without requiring additional user interaction."], "name": "CVE-2026-118254", "public_date": "2026-10-28T18:13:20Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118254\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118254\nhttps://github.com/highcharts/highcharts/commit/1e8ded84d52191883965641b863cf0c73eb759aa\nhttps://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0\nhttps://github.com/highcharts/highcharts/security/advisories/GHSA-r5wg-q8fc-p6w2"], "statement": "This vulnerability is evaluated as Moderate severity because successful exploitation requires an attacker to control the grid's localization configuration and pagination must be explicitly enabled. In typical enterprise web applications, language options are statically defined or restricted to administrative inputs rather than directly accepting untrusted user data. If triggered, the vulnerability allows cross-site scripting execution within the client's browser session, affecting the integrity and confidentiality of the hosting origin.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,3.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "grid-lite", "source": "cna", "vendor": "@highcharts"}, "product": "grid-lite", "vendor": "highcharts"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[2.0.0,3.2.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "grid-pro", "source": "cna", "vendor": "@highcharts"}, "product": "grid-pro", "vendor": "highcharts"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,13.0.0-beta.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "highcharts", "source": "cna", "vendor": "highcharts"}, "product": "highcharts", "vendor": "highcharts"}], "created": "2026-10-28T19:45:07.049590+00:00", "updated": "2026-10-28T21:45:07.177216+00:00", "vendors": ["highcharts", "highcharts$PRODUCT$grid-lite", "highcharts$PRODUCT$grid-pro", "highcharts$PRODUCT$highcharts"]}