Is CVE-2026-118255 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118255 being exploited in the wild.

How severe is CVE-2026-118255?

High severity, with a CVSS score of 4, published 28 October 2026.

Which products and versions are affected?

Highcharts Grid 2.0.0 to 3.1.x; @highcharts/dashboards (npm) >= 3.2.0, = 2.0.0, <= 3.1.0, SEMVER:introduced=2.0.0,fixed=3.2.0.

How is CVE-2026-118255 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118255?

Check whether you run Highcharts Grid, @highcharts/dashboards (npm) or @highcharts/grid-pro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118255: Highcharts Grid unvalidated credits href XSS

Q: Is there a fix for CVE-2026-118255?

Yes. @highcharts/dashboards (npm): upgrade to 4.0.0 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Until then: Upgrade to Highcharts Grid Pro 3.2.0 or later, which validates URL schemes against an allowed list before rendering the credits link. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

CVE-2026-118255 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts Grid is a charting component used to display data visualizations in web applications. An attacker who controls the Grid configuration can inject a malicious JavaScript URL into the credits link, which when clicked by a user runs arbitrary code in the web application's context, potentially stealing session data or user information.

Technologies: Highcharts Grid, @highcharts/dashboards (npm), @highcharts/grid-pro (npm). Vendors: Highcharts, npm.

Quick answers

Is CVE-2026-118255 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118255 being exploited in the wild.
How severe is CVE-2026-118255?: High severity, with a CVSS score of 4, published 28 October 2026.
Which products and versions are affected?: Highcharts Grid 2.0.0 to 3.1.x; @highcharts/dashboards (npm) >= 3.2.0, <= 3.6.0, SEMVER:introduced=3.2.0,fixed=4.0.0; @highcharts/grid-pro (npm) >= 2.0.0, <= 3.1.0, SEMVER:introduced=2.0.0,fixed=3.2.0.
Is there a fix for CVE-2026-118255?: Yes. @highcharts/dashboards (npm): upgrade to 4.0.0 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Until then: Upgrade to Highcharts Grid Pro 3.2.0 or later, which validates URL schemes against an allowed list before rendering the credits link.</anigation> </invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118255 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118255?: Check whether you run Highcharts Grid, @highcharts/dashboards (npm) or @highcharts/grid-pro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@highcharts/dashboards (npm): upgrade to 4.0.0 or later
```
npm install @highcharts/dashboards@4.0.0
```
@highcharts/grid-pro (npm): upgrade to 3.2.0 or later
```
npm install @highcharts/grid-pro@3.2.0
```

Upgrade to Highcharts Grid Pro 3.2.0 or later, which validates URL schemes against an allowed list before rendering the credits link.</anigation> </invoke>

Technical details

The vulnerability is a cross-site scripting (XSS) issue in the credits link handler. Highcharts Grid versions 2.0.0 through 3.2.0 fail to validate the URL scheme in the credits.href configuration option before applying it to an anchor element. An attacker controlling Grid configuration can supply a javascript: URL that will be executed with the origin of the hosting page when a user activates the link. The fix validates the href against AST allowed references before setting it on the link element.

Affected products

Highcharts Grid 2.0.0 to 3.1.x

Identifiers

CVE-2026-118255
GHSA-6hgp-fmhr-mrg4

Timeline

2026-10-28: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.