# CVE-2026-118242: Highcharts Grid arbitrary script execution in icon rendering

Source: https://junglewise.ai/threats/cve-2026-118242-highcharts-js-is-a-javascript-charting-library-based-on-svg-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118242 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts Grid is a JavaScript library for displaying tabular data with sorting and pagination controls. Versions 2.3.0 to 3.1.0 allow attackers who control Grid configuration to inject malicious event handlers into SVG icons, which execute when users interact with sort buttons or pagination controls. An attacker can exploit this to steal data, redirect users, or perform actions on their behalf.

Technologies: [Highcharts Grid](https://junglewise.ai/threats/technologies/highcharts-grid), [Highcharts Grid Pro](https://junglewise.ai/threats/technologies/grid-pro), [@highcharts/grid-pro (npm)](https://junglewise.ai/threats/technologies/highcharts-grid-pro). Vendors: [Highcharts](https://junglewise.ai/threats/vendors/highcharts), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-118242 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118242 being exploited in the wild.

**How severe is CVE-2026-118242?** High severity, with a CVSS score of 4, published 28 October 2026.

**Which products and versions are affected?** Highcharts Grid 2.3.0 to 3.1.0; Highcharts Grid Lite 2.3.0 to 3.1.0; Highcharts Grid Pro 2.3.0 to 3.1.0; @highcharts/grid-lite (npm) >= 2.3.0, <= 3.1.0, SEMVER:introduced=2.3.0,fixed=3.2.0; and 1 more.

**Is there a fix for CVE-2026-118242?** Yes. @highcharts/grid-lite (npm): upgrade to 3.2.0 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Until then: If Grid configuration comes from untrusted sources, apply the provided workaround snippet that sanitizes the rendering.icons object by filtering child attributes to a safe allowlist (d, fill, opacity, stroke, stroke-width, stroke-linecap, stroke-linejoin, transform) before Grid initialization. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118242 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118242?** Check whether you run Highcharts Grid, Highcharts Grid Lite, Highcharts Grid Pro or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @highcharts/grid-lite (npm): upgrade to 3.2.0 or later

  ```sh
  npm install @highcharts/grid-lite@3.2.0
  ```

- @highcharts/grid-pro (npm): upgrade to 3.2.0 or later

  ```sh
  npm install @highcharts/grid-pro@3.2.0
  ```


If Grid configuration comes from untrusted sources, apply the provided workaround snippet that sanitizes the rendering.icons object by filtering child attributes to a safe allowlist (d, fill, opacity, stroke, stroke-width, stroke-linecap, stroke-linejoin, transform) before Grid initialization.

## Technical details

The vulnerability exists in how Highcharts Grid constructs SVG path elements from icon definition objects by copying all keys as attributes via raw setAttribute() without filtering attribute names. An attacker can supply event-handler attributes (e.g., onmouseover, onclick) in custom icon definitions that override built-in icons, causing script execution in the page origin when triggered. Exploitation requires the attacker to control Grid configuration and a user to interact with an affected icon.

## Affected products

- Highcharts Grid 2.3.0 to 3.1.0
- Highcharts Grid Lite 2.3.0 to 3.1.0
- Highcharts Grid Pro 2.3.0 to 3.1.0

## Identifiers

- CVE-2026-118242
- GHSA-6g3c-p4fg-xv47

## Timeline

- 2026-09-29: disclosed
- 2026-10-28: patched

## References

- [https://github.com/highcharts/highcharts/commit/8fc970658fee6601625b42da29d27c3ef7c45e30](https://github.com/highcharts/highcharts/commit/8fc970658fee6601625b42da29d27c3ef7c45e30)
- [https://github.com/highcharts/highcharts/security/advisories/GHSA-6g3c-p4fg-xv47](https://github.com/highcharts/highcharts/security/advisories/GHSA-6g3c-p4fg-xv47)

## Related threats

- [Highcharts Grid unvalidated credits href XSS](https://junglewise.ai/threats/cve-2026-118255-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Grid cross-site scripting in pagination language strings](https://junglewise.ai/threats/cve-2026-118254-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts DataTable prototype pollution via column ID](https://junglewise.ai/threats/cve-2026-118247-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Grid Pro DOM-based XSS via unfiltered renderer attributes](https://junglewise.ai/threats/cve-2026-116797-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)