CVE-2026-116797

Name of the Vulnerable Software and Affected Versions Highcharts Grid Pro versions 2.0.0 through 3.1.9

Description Input-type cell renderers copy entries from the attributes option to input or select elements using raw setAttribute calls without validating attribute names. An attacker who can control the Grid configuration can inject event-handler attributes via cells.renderer.attributes or cells.editMode.renderer.attributes. This allows the execution of arbitrary scripts in the origin of the hosting page when a user hovers over, focuses, or begins editing a cell. This issue also affects the Pro DataGrid included in the Dashboards package.

Recommendations Update Highcharts Grid Pro to version 3.2.0. As a temporary mitigation, implement a scrubbing function to ensure only allowed attributes (such as autofocus, checked, max, maxlength, min, minlength, multiple, pattern, placeholder, size, and step) are processed within the cells.renderer.attributes and cells.editMode.renderer.attributes configurations.