Description
The component language strings shown in the edit mode sidebar are parsed as HTML rather than inserted as text. An attacker who controls those language options can supply markup carrying event handlers, which execute in the origin of the page hosting the dashboard once the sidebar renders the affected labels.
Recommendation
Update the @highcharts/dashboards package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, <= 4.2.2
- Patched version(s): 4.2.3
References
Could your website be exposed too?
SmartScanner can check your website for Highcharts Dashboards parses sidebar component labels as HTML and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Highcharts Dashboards parses fullscreen labels as HTML - CVE-2026-118253
- Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute` - @highcharts/dashboards - CVE-2026-116797
- Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` - CVE-2026-118243
- Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. - @highcharts/dashboards - CVE-2026-118247
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026