Highcharts Grid parses pagination language options as HTML - @highcharts/grid-lite

Description

The pagination language strings are written into the DOM as markup rather than as text. An attacker who controls those language options can supply elements carrying event handlers, and those handlers execute in the origin of the page hosting the Grid when the pagination controls render.

Recommendation

Update the @highcharts/grid-lite package to the latest compatible version. Followings are version details:

• Affected version(s): >= 2.0.0, <= 3.1.0
• Patched version(s): 3.2.0

References

• GHSA-r5wg-q8fc-p6w2
• CVE-2026-118254
• CWE-79
• CAPEC-310