Skip to main content
cve.nowby Sazabi
← npm
npmPackage

@highcharts/grid-pro

5 known vulnerabilities (4 high, 1 medium), with the versions each affects and the releases that fix them.

Latest release
3.2.0 (Sep 18, 2026): no advisory affects it
Newest unaffected release
3.2.0 (Sep 18, 2026), the latest release
Advisories
5 · 4 high, 1 medium
Weekly downloads
5,666
Dependents
1
Releases
10 since 2.0.0 (Oct 29, 2025)
Registry
npm
Releases read
Nov 8, 2026

Version timeline

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • Highcharts Grid: javascript: URL in credits.href runs script on click

    Affected: from 2.0.0, fixed in 3.2.0.

    Fixed in 3.2.0 (released Sep 18, 2026, 40 days before disclosure).

    The latest release, 3.2.0, is not affected.

    30% of @highcharts/grid-pro downloads last week were affected versions (2.1K).

  • Highcharts Grid: pagination language options are parsed as HTML

    Affected: from 2.0.0, fixed in 3.2.0.

    Fixed in 3.2.0 (released Sep 18, 2026, 40 days before disclosure).

    The latest release, 3.2.0, is not affected.

    30% of @highcharts/grid-pro downloads last week were affected versions (2.1K).

  • CVE-2026-118247Medium 6.9

    Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `proto` as an existing column.

    Affected: from 2.0.0, fixed in 3.2.0.

    Fixed in 3.2.0 (released Sep 18, 2026, 40 days before disclosure).

    The latest release, 3.2.0, is not affected.

    30% of @highcharts/grid-pro downloads last week were affected versions (2.1K).

  • Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

    Affected: from 2.3.0, fixed in 3.2.0.

    Fixed in 3.2.0 (released Sep 18, 2026, 40 days before disclosure).

    The latest release, 3.2.0, is not affected.

    19% of @highcharts/grid-pro downloads last week were affected versions (1.4K).

  • Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

    Affected: from 2.0.0, fixed in 3.2.0.

    Fixed in 3.2.0 (released Sep 18, 2026, 40 days before disclosure).

    The latest release, 3.2.0, is not affected.

    30% of @highcharts/grid-pro downloads last week were affected versions (2.1K).