CVE-2026-118254

— UNSCOREDpublic exploit available

Published 2026-10-28 · Updated 2026-10-28

AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.

NVD description

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.

Weaknesses

CWE-79

Public exploit & PoC references

https://github.com/highcharts/highcharts/commit/1e8ded84d52191883965641b863cf0c73eb759aa
https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0
https://github.com/highcharts/highcharts/security/advisories/GHSA-r5wg-q8fc-p6w2

All references

https://github.com/highcharts/highcharts/commit/1e8ded84d52191883965641b863cf0c73eb759aa
https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0
https://github.com/highcharts/highcharts/security/advisories/GHSA-r5wg-q8fc-p6w2

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

MEDIUMCVE-2012-20003PoC
MEDIUMCVE-2012-20004PoC
MEDIUMCVE-2012-20005PoC
MEDIUMCVE-2013-20009PoC
MEDIUMCVE-2014-125131PoC
MEDIUMCVE-2014-125132PoC
MEDIUMCVE-2016-20098PoC
MEDIUMCVE-2016-20102PoC

Related by shared AI tags and CWE weakness class. Browse the full archive.