CVE-2026-116797

A flaw was found in Highcharts Grid Pro. Cross-Site Scripting XSS can occur when an attacker who controls table column configurations injects malicious event-handler attributes into rendered input elements. When a user interacts with or edits an affected cell, the injected script executes in thei...

Linux Distros Unpatched Vulnerability : CVE-2026-116797

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118247 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118247 Source advisory: SNYK:JS-HIGHCHARTSGRIDPRO-21826803...

Prototype Pollution

Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Prototype Pollution via column and row ID handling in DataTable and DataTableCore, where attacker-controlled column IDs such as proto or constructor are passed to object property...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118254 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118254 Source advisory: SNYK:JS-HIGHCHARTSGRIDPRO-21826797...

Cross-site Scripting (XSS)

Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Pagination language configuration sinks in Pagination.ts, where user-controlled text is assigned to innerHTML for page info, page numbers, ellipsis...

Cross-site Scripting (XSS)

Overview @highcharts/grid-pro is a Highcharts Grid Pro framework Affected versions of this package are vulnerable to Cross-site Scripting XSS via the credits.href option in Credits.ts and CreditsPro.ts, where a javascript: URL supplied in the Grid configuration is applied directly to the credits...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118255 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118255 Source advisory: SNYK:JS-HIGHCHARTSGRIDPRO-21826793...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118255 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118255 Source advisory: OSV:GHSA-6HGP-FMHR-MRG4...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118255 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118255 Source advisory: GHSA-6HGP-FMHR-MRG4...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118254 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118254 Source advisory: GHSA-R5WG-Q8FC-P6W2...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118254 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118254 Source advisory: OSV:GHSA-R5WG-Q8FC-P6W2...

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Impact The input-type cell renderers copy every entry of the renderer's attributes option onto the input or select element they create, without checking the attribute names. An attacker who controls the Grid configuration can supply entries under a column's cells.renderer.attributes or...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-116797 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-116797 Source advisory: GHSA-5GHW-9MGR-JVX2...

GHSA-5GHW-9MGR-JVX2 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Impact The input-type cell renderers copy every entry of the renderer's attributes option onto the input or select element they create, without checking the attribute names. An attacker who controls the Grid configuration can supply entries under a column's cells.renderer.attributes or...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-116797 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-116797 Source advisory: OSV:GHSA-5GHW-9MGR-JVX2...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118242 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118242 Source advisory: OSV:GHSA-6G3C-P4FG-XV47...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118242 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118242 Source advisory: GHSA-6G3C-P4FG-XV47...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118247 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118247 Source advisory: OSV:GHSA-C75X-9X9H-28RM...

@highcharts/grid-pro-react (>=0.1.0, <=3.1.0) potentially affected by CVE-2026-118247 via @highcharts/grid-pro (>=2.3.1, <=3.1.0)

@highcharts/grid-pro NPM version =2.3.1, =0.1.0, =3.1.0 Source cves: CVE-2026-118247 Source advisory: GHSA-C75X-9X9H-28RM...