CVE-2026-118255

The Highcharts Grid JavaScript charting library (versions 2.0.0 until 3.2.0 ) is vulnerable to a Cross-Site Scripting (XSS) flaw due to a lack of URL scheme validation for the credits.href attribute. An attacker capable of controlling the Grid configuration can inject a javascript: URL , which ex...