GHSA-58G7-7F52-H92C Highcharts Dashboards parses fullscreen labels as HTML

Impact The edit mode fullscreen labels are parsed as HTML when the corresponding control is rendered. An attacker who controls the Dashboards language options can supply markup carrying event handlers, which then execute in the origin of the page hosting the dashboard. Exploitation requires that...

CVE-2026-118253 Highcharts Dashboards: fullscreen labels are parsed as HTML

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which...

CVE-2026-118253

Highcharts Dashboards, a JavaScript charting library, is vulnerable to Cross-Site Scripting (XSS) in versions 1.0.0 through 4.2.3 . The root cause is that the edit mode parses fullscreen language labels as HTML instead of plain text. An attacker who can control the Dashboards language options can...