# CVE-2026-116797: Highcharts Grid Pro DOM-based XSS via unfiltered renderer attributes

Source: https://junglewise.ai/threats/cve-2026-116797-highcharts-js-is-a-javascript-charting-library-based-on-svg-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-116797 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts Grid Pro is a JavaScript data grid component used to display and edit tabular data in web applications. An attacker who controls the grid's column configuration can inject malicious event handlers into input elements, causing arbitrary JavaScript to execute in the hosting page when users interact with cells (hover, focus, or edit). This could lead to session hijacking, credential theft, or other client-side attacks.

Technologies: [Highcharts Grid Pro](https://junglewise.ai/threats/technologies/grid-pro), [@highcharts/dashboards (npm)](https://junglewise.ai/threats/technologies/highcharts-dashboards), [@highcharts/grid-pro (npm)](https://junglewise.ai/threats/technologies/highcharts-grid-pro). Vendors: [Highcharts](https://junglewise.ai/threats/vendors/highcharts), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-116797 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-116797 being exploited in the wild.

**How severe is CVE-2026-116797?** High severity, with a CVSS score of 4, published 28 October 2026.

**Which products and versions are affected?** Highcharts Dashboards (Pro DataGrid) 3.6.0; Highcharts Grid Pro 2.0.0 through 3.1.0; @highcharts/dashboards (npm) = 3.6.0, SEMVER:introduced=3.6.0,fixed=4.0.0; @highcharts/grid-pro (npm) >= 2.0.0, <= 3.1.0, SEMVER:introduced=2.0.0,fixed=3.2.0.

**Is there a fix for CVE-2026-116797?** Yes. @highcharts/dashboards (npm): upgrade to 4.0.0 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Until then: If column configuration comes from untrusted sources, implement an allowlist filter on renderer attributes. Whitelist only non-event attributes (autofocus, checked, max, maxlength, min, minlength, multiple, pattern, placeholder, size, step) and remove any others from cells.renderer.attributes and cells.editMode.renderer.attributes before passing configuration to the Grid. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-116797 attacked?** It is attacked over the network.

**Am I affected by CVE-2026-116797?** Check whether you run Highcharts Dashboards (Pro DataGrid), Highcharts Grid Pro, @highcharts/dashboards (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @highcharts/dashboards (npm): upgrade to 4.0.0 or later

  ```sh
  npm install @highcharts/dashboards@4.0.0
  ```

- @highcharts/grid-pro (npm): upgrade to 3.2.0 or later

  ```sh
  npm install @highcharts/grid-pro@3.2.0
  ```


If column configuration comes from untrusted sources, implement an allowlist filter on renderer attributes. Whitelist only non-event attributes (autofocus, checked, max, maxlength, min, minlength, multiple, pattern, placeholder, size, step) and remove any others from cells.renderer.attributes and cells.editMode.renderer.attributes before passing configuration to the Grid.

## Technical details

The vulnerability is a DOM-based XSS in Grid Pro's input and select cell renderers. These renderers copy all entries from cells.renderer.attributes and cells.editMode.renderer.attributes maps directly onto rendered elements via raw setAttribute calls without validating attribute names, allowing event-handler attributes like onmouseover or onfocus to be injected. Exploitation requires an attacker to control the grid configuration and a user to interact with the affected input element.

## Affected products

- Highcharts Grid Pro 2.0.0 through 3.1.0
- Highcharts Dashboards (Pro DataGrid) 3.6.0

## Identifiers

- CVE-2026-116797
- GHSA-5ghw-9mgr-jvx2

## Timeline

- 2026-09-29: disclosed
- 2026-09-17: patched

## References

- [https://github.com/highcharts/highcharts/commit/52abd4f8f8db87dd20eab7c01444112380e30e98](https://github.com/highcharts/highcharts/commit/52abd4f8f8db87dd20eab7c01444112380e30e98)
- [https://github.com/highcharts/highcharts/security/advisories/GHSA-5ghw-9mgr-jvx2](https://github.com/highcharts/highcharts/security/advisories/GHSA-5ghw-9mgr-jvx2)

## Related threats

- [Highcharts Grid unvalidated credits href XSS](https://junglewise.ai/threats/cve-2026-118255-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Grid cross-site scripting in pagination language strings](https://junglewise.ai/threats/cve-2026-118254-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Dashboards cross-site scripting in fullscreen label](https://junglewise.ai/threats/cve-2026-118253-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Dashboards XSS in edit-mode sidebar](https://junglewise.ai/threats/cve-2026-118252-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts DataTable prototype pollution via column ID](https://junglewise.ai/threats/cve-2026-118247-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)