Is CVE-2026-118254 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118254 being exploited in the wild.

How severe is CVE-2026-118254?

High severity, with a CVSS score of 4, published 28 October 2026.

Which products and versions are affected?

Highcharts Grid 2.0.0 to 3.1.x; @highcharts/grid-lite (npm) >= 2.0.0, = 2.0.0, <= 3.1.0, SEMVER:introduced=2.0.0,fixed=3.2.0.

Is there a fix for CVE-2026-118254?

Yes. @highcharts/grid-lite (npm): upgrade to 3.2.0 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118254 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118254?

Check whether you run Highcharts Grid, @highcharts/grid-lite (npm) or @highcharts/grid-pro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118254: Highcharts Grid cross-site scripting in pagination language strings

Q: Is there a fix for CVE-2026-118254?

Yes. @highcharts/grid-lite (npm): upgrade to 3.2.0 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118254 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118254?

Check whether you run Highcharts Grid, @highcharts/grid-lite (npm) or @highcharts/grid-pro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118254 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts Grid is a JavaScript library that renders interactive data tables and grids in web applications. An attacker who controls the pagination language configuration can inject malicious code into pagination controls, which executes in the context of the hosting webpage when pagination is rendered. This allows attackers to steal user data or perform actions on behalf of users without requiring any user interaction beyond visiting the page.

Technologies: Highcharts Grid, @highcharts/grid-pro (npm). Vendors: Highcharts, npm.

Quick answers

Is CVE-2026-118254 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118254 being exploited in the wild.
How severe is CVE-2026-118254?: High severity, with a CVSS score of 4, published 28 October 2026.
Which products and versions are affected?: Highcharts Grid 2.0.0 to 3.1.x; @highcharts/grid-lite (npm) >= 2.0.0, <= 3.1.0, SEMVER:introduced=2.0.0,fixed=3.2.0; @highcharts/grid-pro (npm) >= 2.0.0, <= 3.1.0, SEMVER:introduced=2.0.0,fixed=3.2.0.
Is there a fix for CVE-2026-118254?: Yes. @highcharts/grid-lite (npm): upgrade to 3.2.0 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118254 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118254?: Check whether you run Highcharts Grid, @highcharts/grid-lite (npm) or @highcharts/grid-pro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@highcharts/grid-lite (npm): upgrade to 3.2.0 or later
```
npm install @highcharts/grid-lite@3.2.0
```
@highcharts/grid-pro (npm): upgrade to 3.2.0 or later
```
npm install @highcharts/grid-pro@3.2.0
```

Technical details

The vulnerability is a stored cross-site scripting (XSS) flaw in the pagination component where user-supplied language strings are written to the DOM using innerHTML instead of textContent. An attacker controlling the Grid language configuration can inject event-handler-bearing HTML elements that execute in the origin of the hosting page. The flaw requires pagination to be enabled but no further user interaction; the fix changes innerHTML to textContent and innerText for affected DOM writes.

Affected products

Highcharts Highcharts Grid 2.0.0 to 3.1.x

Identifiers

CVE-2026-118254
GHSA-r5wg-q8fc-p6w2

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.