Description
The pagination language strings are written into the DOM as markup rather than as text. An attacker who controls those language options can supply elements carrying event handlers, and those handlers execute in the origin of the page hosting the Grid when the pagination controls render.
Recommendation
Update the @highcharts/grid-pro package to the latest compatible version. Followings are version details:
- Affected version(s): >= 2.0.0, <= 3.1.0
- Patched version(s): 3.2.0
References
Could your website be exposed too?
SmartScanner can check your website for Highcharts Grid parses pagination language options as HTML and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Highcharts Grid parses pagination language options as HTML - @highcharts/grid-lite - CVE-2026-118254
- Highcharts Dashboards parses sidebar component labels as HTML - CVE-2026-118252
- Highcharts Dashboards parses fullscreen labels as HTML - CVE-2026-118253
- Highcharts Grid: `javascript:` URL in credits.href runs script on click - CVE-2026-118255
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026