Linux Distros Unpatched Vulnerability : CVE-2026-116797

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and...

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Impact A custom icon supplied under rendering.icons as an icon definition object is built by creating an SVG path for each of its child entries and setting every key of that entry as an attribute of the path, without filtering the attribute names; only the string form of the option is passed...

GHSA-6G3C-P4FG-XV47 Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Impact A custom icon supplied under rendering.icons as an icon definition object is built by creating an SVG path for each of its child entries and setting every key of that entry as an attribute of the path, without filtering the attribute names; only the string form of the option is passed...

CVE-2026-118242 Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler...

CVE-2026-118242

The Highcharts JS charting library (versions 2.3.0 through 3.2.0 ) is vulnerable to Cross-Site Scripting (XSS) via the Highcharts Grid component. The root cause is the use of the raw setAttribute method to copy child keys from rendering.icons object definitions into SVG path elements. An attacker...

CVE-2026-118242 Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler...

CVE-2026-116797 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

CVE-2026-116797

Highcharts Grid Pro, versions 2.0.0 through 3.2.0 , is vulnerable to a Cross-Site Scripting (XSS) flaw via CWE-79 . The root cause is the use of raw setAttribute calls to copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements. An attacker contro...

CVE-2026-116797 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

CVE-2026-116797 Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column...

CVE-2026-118242: Improper Neutralization of Input During Web Page Generation

Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler...

svelte-poc

Svelte 5.57.0 - client-side XSS via spread attributes SvelteK...

GHSA-4W3W-2RP5-G8JM xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...

NPM: xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

NPM: xmldom: Attribute name injection via setAttribute bypasses requireWellFormed vulnerability discovered by ? in WordPress Npm xmldom versions = 0.6.0...

xmldom: Attribute name injection via setAttribute() bypasses requireWellFormed

Summary Element.setAttribute in @xmldom/xmldom bypasses attribute name validation by calling the private createAttributename method, which performs no validation. The public createAttribute method correctly validates names against an anchored QName pattern, but setAttribute never uses it. The...

EUVD-2026-69215

xmldom: Attribute name injection via setAttribute bypasses requireWellFormed...

XMLDOM XSS

The vulnerability of the Element.setAttribute method in the XML document access and manipulation module XMLDOM is related to errors in processing XML requests. Exploiting this vulnerability allows a malicious actor to perform cross-site scripting attacks XSS remotely...

XML Injection

Overview @xmldom/xmldom is a javascript ponyfill to provide the following APIs that are present in modern browsers to other runtimes. Since version 0.7.0 this package is published to npm as @xmldom/xmldom and no longer as xmldom Affected versions of this package are vulnerable to XML Injection vi...

CVE-2026-83605

A flaw was found in xmldom, a JavaScript XML DOM parser. The Element.setAttribute function does not properly validate attribute names, allowing a remote attacker to inject specially crafted attribute names. This can lead to the injection of additional attributes, including event handlers, into...

CVE-2026-83605

xmldom is a pure JavaScript W3C standard-based XML DOM Level 2 Core DOMParser and XMLSerializer module. Prior to @xmldom/xmldom versions 0.8.14 and 0.9.11, and in xmldom version 0.6.0 and earlier, Element.setAttribute calls the private createAttributename path without validating the attribute nam...