Highcharts Grid parses pagination language options as HTML

Impact The pagination language strings are written into the DOM as markup rather than as text. An attacker who controls those language options can supply elements carrying event handlers, and those handlers execute in the origin of the page hosting the Grid when the pagination controls render...

CVE-2026-118254 Highcharts Grid: pagination language options are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...

CVE-2026-118254

The Highcharts JS charting library (versions 2.0.0 through 3.2.0 ) contains a vulnerability where pagination language strings are incorrectly written into the DOM as HTML markup instead of plain text. An attacker who can control the Grid language configuration can inject elements with event handl...

EUVD-2026-112356

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the...