# CVE-2026-118255: Highcharts Grid unvalidated credits href XSS

Source: https://junglewise.ai/threats/cve-2026-118255-highcharts-js-is-a-javascript-charting-library-based-on-svg-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118255 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts Grid is a charting component used to display data visualizations in web applications. An attacker who controls the Grid configuration can inject a malicious JavaScript URL into the credits link, which when clicked by a user runs arbitrary code in the web application's context, potentially stealing session data or user information.

Technologies: [Highcharts Grid](https://junglewise.ai/threats/technologies/highcharts-grid), [@highcharts/dashboards (npm)](https://junglewise.ai/threats/technologies/highcharts-dashboards), [@highcharts/grid-pro (npm)](https://junglewise.ai/threats/technologies/highcharts-grid-pro). Vendors: [Highcharts](https://junglewise.ai/threats/vendors/highcharts), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-118255 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118255 being exploited in the wild.

**How severe is CVE-2026-118255?** High severity, with a CVSS score of 4, published 28 October 2026.

**Which products and versions are affected?** Highcharts Grid 2.0.0 to 3.1.x; @highcharts/dashboards (npm) >= 3.2.0, <= 3.6.0, SEMVER:introduced=3.2.0,fixed=4.0.0; @highcharts/grid-pro (npm) >= 2.0.0, <= 3.1.0, SEMVER:introduced=2.0.0,fixed=3.2.0.

**Is there a fix for CVE-2026-118255?** Yes. @highcharts/dashboards (npm): upgrade to 4.0.0 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Until then: Upgrade to Highcharts Grid Pro 3.2.0 or later, which validates URL schemes against an allowed list before rendering the credits link.</anigation>
</invoke> Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118255 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118255?** Check whether you run Highcharts Grid, @highcharts/dashboards (npm) or @highcharts/grid-pro (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @highcharts/dashboards (npm): upgrade to 4.0.0 or later

  ```sh
  npm install @highcharts/dashboards@4.0.0
  ```

- @highcharts/grid-pro (npm): upgrade to 3.2.0 or later

  ```sh
  npm install @highcharts/grid-pro@3.2.0
  ```


Upgrade to Highcharts Grid Pro 3.2.0 or later, which validates URL schemes against an allowed list before rendering the credits link.</anigation>
</invoke>

## Technical details

The vulnerability is a cross-site scripting (XSS) issue in the credits link handler. Highcharts Grid versions 2.0.0 through 3.2.0 fail to validate the URL scheme in the credits.href configuration option before applying it to an anchor element. An attacker controlling Grid configuration can supply a javascript: URL that will be executed with the origin of the hosting page when a user activates the link. The fix validates the href against AST allowed references before setting it on the link element.

## Affected products

- Highcharts Grid 2.0.0 to 3.1.x

## Identifiers

- CVE-2026-118255
- GHSA-6hgp-fmhr-mrg4

## Timeline

- 2026-10-28: advisory

## References

- [https://github.com/highcharts/highcharts/commit/45b74403acafbe9f621c4a343506721d9129e991](https://github.com/highcharts/highcharts/commit/45b74403acafbe9f621c4a343506721d9129e991)
- [https://github.com/highcharts/highcharts/pull/25351](https://github.com/highcharts/highcharts/pull/25351)

## Related threats

- [Highcharts Grid cross-site scripting in pagination language strings](https://junglewise.ai/threats/cve-2026-118254-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Dashboards cross-site scripting in fullscreen label](https://junglewise.ai/threats/cve-2026-118253-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Dashboards XSS in edit-mode sidebar](https://junglewise.ai/threats/cve-2026-118252-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts DataTable prototype pollution via column ID](https://junglewise.ai/threats/cve-2026-118247-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Dashboards arbitrary property injection via chartConstructor](https://junglewise.ai/threats/cve-2026-118245-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)