CVE-2026-118254 Highcharts Grid: pagination language options are parsed as HTML
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-118254?
CVE-2026-118254 is a high-severity vulnerability in @highcharts grid-lite, published on 28 Oct 2026.
Official description
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.
Weakness: CWE-79
Which versions are affected by CVE-2026-118254?
4 open source packages ship an affected version, including @highcharts/grid-lite and @highcharts/grid-pro.
| Package | Affected | Fixed in |
|---|---|---|
@highcharts/grid-lite npm | From 2.0.0 | 3.2.0 |
@highcharts/grid-lite npm | From 2.0.0 | 3.2.0 |
@highcharts/grid-pro npm | From 2.0.0 | 3.2.0 |
@highcharts/grid-pro npm | From 2.0.0 | 3.2.0 |
How do I fix CVE-2026-118254?
Upgrade @highcharts/grid-lite to 3.2.0 or later.
Is CVE-2026-118254 being exploited?
There is no known exploitation of CVE-2026-118254 in the wild and no public exploit code.
Sources
Also known as GHSA-r5wg-q8fc-p6w2.