Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 3.2.0, 4.0.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: total
Summary
Highcharts Grid Pro, a data grid component for JavaScript web pages, is affected. An attacker who can control column configuration could inject event-handler attributes that run malicious scripts in the hosting page when users interact with input cells, potentially compromising that page's users and data.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw setAttribute calls. An attacker who controls column configuration can add event-handler attributes to every rendered row or to the control created when a cell enters edit mode. Script then runs in the hosting page origin when a user hovers over or focuses an input or begins editing. This issue is fixed in Grid Pro 3.2.0.
Timeline
- CVE published
- First seen by cve.now
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: total
- Record last updated
Affected versions
- highcharts highcharts
From 2.0.0 · fixed in 3.2.0
- @highcharts grid-pro
From 2.0.0 · fixed in 3.2.0
- @highcharts dashboards
From 3.6.0 · fixed in 4.0.0
- @highcharts/grid-pronpm
From 2.0.0 · fixed in 3.2.0
- @highcharts/dashboardsnpm
From 3.6.0 · fixed in 4.0.0