CVE-2026-118252

Name of the Vulnerable Software and Affected Versions Highcharts JS versions 1.0.0 through 4.2.2

Description Highcharts Dashboards edit-mode sidebar parses component language strings as HTML instead of inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing event handlers that execute in the hosting page origin when a user opens the edit-mode sidebar and the affected labels render.

Recommendations Update to version 4.2.3. As a temporary workaround, disable Edit Mode by setting editMode.enabled: false. As a temporary workaround, patch the EditMode prototype at application startup to escape HTML in the lang.sidebar labels.