Description
An attacker who controls the Grid configuration can set credits.href to a javascript: URL. The value is not validated against an allowed-scheme list before it is applied to the credits link, so activating that link runs attacker-supplied script in the origin of the page hosting the Grid.
Recommendation
Update the @highcharts/dashboards package to the latest compatible version. Followings are version details:
- Affected version(s): >= 3.2.0, <= 3.6.0
- Patched version(s): 4.0.0
References
Could your website be exposed too?
SmartScanner can check your website for Highcharts Grid: `javascript:` URL in credits.href runs script on click - @highcharts/dashboards and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Highcharts Grid: `javascript:` URL in credits.href runs script on click - CVE-2026-118255
- Highcharts: `javascript:` URL in credits.href runs script on click - CVE-2026-118251
- Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts - CVE-2026-116796
- Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. - @highcharts/dashboards - CVE-2026-118247
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026