Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@highcharts/dashboards

7 known vulnerabilities (5 high, 2 medium), with the versions each affects and the releases that fix them.

Latest release
4.2.3 (Sep 20, 2026): no advisory affects it
Newest unaffected release
4.2.3 (Sep 20, 2026), the latest release
Advisories
7 · 5 high, 2 medium
Weekly downloads
9,397
Dependents
2
Releases
28 since 1.0.0 (Jul 4, 2023)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 7

  • Highcharts Grid: javascript: URL in credits.href runs script on click

    Affected: from 3.2.0, fixed in 4.0.0.

    Fixed in 4.0.0 (released Oct 29, 2025, 364 days before disclosure).

    The latest release, 4.2.3, is not affected.

    24% of @highcharts/dashboards downloads last week were affected versions (2.5K).

  • Highcharts Dashboards: fullscreen labels are parsed as HTML

    Affected: from 1.0.0, fixed in 4.2.3.

    Fixed in 4.2.3 (released Sep 20, 2026, 38 days before disclosure).

    The latest release, 4.2.3, is not affected.

    75% of @highcharts/dashboards downloads last week were affected versions (7.8K).

  • Highcharts Dashboards: sidebar component labels are parsed as HTML

    Affected: from 1.0.0, fixed in 4.2.3.

    Fixed in 4.2.3 (released Sep 20, 2026, 38 days before disclosure).

    The latest release, 4.2.3, is not affected.

    75% of @highcharts/dashboards downloads last week were affected versions (7.8K).

  • CVE-2026-118247Medium 6.9

    Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `proto` as an existing column.

    Affected: from 1.0.0, fixed in 4.2.2.

    Fixed in 4.2.2 (released Sep 18, 2026, 40 days before disclosure).

    The latest release, 4.2.3, is not affected.

    73% of @highcharts/dashboards downloads last week were affected versions (7.6K).

  • Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace

    Affected: from 1.0.0, fixed in 4.2.2.

    Fixed in 4.2.2 (released Sep 18, 2026, 40 days before disclosure).

    The latest release, 4.2.3, is not affected.

    73% of @highcharts/dashboards downloads last week were affected versions (7.6K).

  • CVE-2026-118243Medium 5.3

    Highcharts Dashboards: `proto` data table id writes sync listeners to `Object.prototype`

    Affected: from 1.0.0, fixed in 4.2.2.

    Fixed in 4.2.2 (released Sep 18, 2026, 40 days before disclosure).

    The latest release, 4.2.3, is not affected.

    73% of @highcharts/dashboards downloads last week were affected versions (7.6K).

  • Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

    Affected: from 3.6.0, fixed in 4.0.0.

    Fixed in 4.0.0 (released Oct 29, 2025, 364 days before disclosure).

    The latest release, 4.2.3, is not affected.

    14% of @highcharts/dashboards downloads last week were affected versions (1.5K).