# @highcharts/dashboards (npm) vulnerabilities 7 known vulnerabilities (5 high, 2 medium), with the versions each affects and the releases that fix them. ## At a glance - Latest release: 4.2.3 (Sep 20, 2026): no advisory affects it - Newest unaffected release: 4.2.3 (Sep 20, 2026), the latest release - Weekly downloads: 9,397 - Dependents: 2 - Releases: 28 since 1.0.0 (Jul 4, 2023) - Registry: https://www.npmjs.com/package/@highcharts/dashboards - Releases read: Nov 8, 2026 ## Version timeline Affected versions per advisory, in version order: - CVE-2026-118255: 3.2.0 to 3.6.0 (4.0.0 is outside it) - CVE-2026-118253: 1.0.0 to 4.2.2 (4.2.3 is outside it) - CVE-2026-118252: 1.0.0 to 4.2.2 (4.2.3 is outside it) - CVE-2026-118247: 1.0.0 to 4.2.1 (4.2.2 is outside it) - CVE-2026-118245: 1.0.0 to 4.2.1 (4.2.2 is outside it) - CVE-2026-118243: 1.0.0 to 4.2.1 (4.2.2 is outside it) - CVE-2026-116797: 3.6.0 (4.0.0 is outside it) ## Advisories (7) ### [CVE-2026-118255](https://cve.now/CVE-2026-118255): Highcharts Grid: javascript: URL in credits.href runs script on click - Severity: High 8.4 - Published: Oct 28, 2026 - Affected: from 3.2.0, fixed in 4.0.0. - Fixed in 4.0.0 (released Oct 29, 2025, 364 days before disclosure). - The latest release, 4.2.3, is not affected. - 24% of @highcharts/dashboards downloads last week were affected versions (2.5K). ### [CVE-2026-118253](https://cve.now/CVE-2026-118253): Highcharts Dashboards: fullscreen labels are parsed as HTML - Severity: High 8.4 - Published: Oct 28, 2026 - Affected: from 1.0.0, fixed in 4.2.3. - Fixed in 4.2.3 (released Sep 20, 2026, 38 days before disclosure). - The latest release, 4.2.3, is not affected. - 75% of @highcharts/dashboards downloads last week were affected versions (7.8K). ### [CVE-2026-118252](https://cve.now/CVE-2026-118252): Highcharts Dashboards: sidebar component labels are parsed as HTML - Severity: High 8.4 - Published: Oct 28, 2026 - Affected: from 1.0.0, fixed in 4.2.3. - Fixed in 4.2.3 (released Sep 20, 2026, 38 days before disclosure). - The latest release, 4.2.3, is not affected. - 75% of @highcharts/dashboards downloads last week were affected versions (7.8K). ### [CVE-2026-118247](https://cve.now/CVE-2026-118247): Highcharts Dashboards / Grid Pro: \`DataTable.setCell\` and column writers treat \`proto\` as an existing column. - Severity: Medium 6.9 - Published: Oct 28, 2026 - Affected: from 1.0.0, fixed in 4.2.2. - Fixed in 4.2.2 (released Sep 18, 2026, 40 days before disclosure). - The latest release, 4.2.3, is not affected. - 73% of @highcharts/dashboards downloads last week were affected versions (7.6K). ### [CVE-2026-118245](https://cve.now/CVE-2026-118245): Highcharts Dashboards: \`chartConstructor\` is an unchecked lookup into the Highcharts namespace - Severity: High 8.6 - Published: Oct 28, 2026 - Affected: from 1.0.0, fixed in 4.2.2. - Fixed in 4.2.2 (released Sep 18, 2026, 40 days before disclosure). - The latest release, 4.2.3, is not affected. - 73% of @highcharts/dashboards downloads last week were affected versions (7.6K). ### [CVE-2026-118243](https://cve.now/CVE-2026-118243): Highcharts Dashboards: \`proto\` data table id writes sync listeners to \`Object.prototype\` - Severity: Medium 5.3 - Published: Oct 28, 2026 - Affected: from 1.0.0, fixed in 4.2.2. - Fixed in 4.2.2 (released Sep 18, 2026, 40 days before disclosure). - The latest release, 4.2.3, is not affected. - 73% of @highcharts/dashboards downloads last week were affected versions (7.6K). ### [CVE-2026-116797](https://cve.now/CVE-2026-116797): Highcharts Grid Pro: cell-renderer \`attributes\` map written with raw \`setAttribute\` - Severity: High 8.5 - Published: Oct 28, 2026 - Affected: from 3.6.0, fixed in 4.0.0. - Fixed in 4.0.0 (released Oct 29, 2025, 364 days before disclosure). - The latest release, 4.2.3, is not affected. - 14% of @highcharts/dashboards downloads last week were affected versions (1.5K). --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/npm/@highcharts/dashboards Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.