Description
The edit mode fullscreen labels are parsed as HTML when the corresponding control is rendered. An attacker who controls the Dashboards language options can supply markup carrying event handlers, which then execute in the origin of the page hosting the dashboard.
Recommendation
Update the @highcharts/dashboards package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, < 4.2.3
- Patched version(s): 4.2.3
References
Could your website be exposed too?
SmartScanner can check your website for Highcharts Dashboards parses fullscreen labels as HTML and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Highcharts Dashboards parses sidebar component labels as HTML - CVE-2026-118252
- Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. - @highcharts/dashboards - CVE-2026-118247
- Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` - CVE-2026-118243
- Highcharts Grid: `javascript:` URL in credits.href runs script on click - @highcharts/dashboards - CVE-2026-118255
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026