Highcharts Grid: pagination language options are parsed as HTML
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 13.0.0-beta.2, 3.2.0
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Highcharts Grid, the data-table component of the Highcharts JavaScript charting library, is affected when its pagination language strings are rendered as HTML rather than plain text. An attacker who can control the Grid language configuration could inject script-capable markup that runs in the context of the web page hosting the grid.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.
Timeline
- CVE published
- First seen by cve.now
Affected versions
- highcharts highcharts
fixed in 13.0.0-beta.2
- @highcharts grid-lite
From 2.0.0 · fixed in 3.2.0
- @highcharts grid-pro
From 2.0.0 · fixed in 3.2.0
- @highcharts/grid-litenpm
From 2.0.0 · fixed in 3.2.0
- @highcharts/grid-pronpm
From 2.0.0 · fixed in 3.2.0