CVE-2026-118252: Highcharts Dashboards parses sidebar component labels as HTML

October 28, 2026

The component language strings shown in the edit mode sidebar are parsed as HTML rather than inserted as text. An attacker who controls those language options can supply markup carrying event handlers, which execute in the origin of the page hosting the dashboard once the sidebar renders the affected labels. Exploitation requires that untrusted data reach the Dashboards language configuration and that a user open the edit mode sidebar.

References

github.com/advisories/GHSA-rcqf-f6h2-ccg9
github.com/highcharts/highcharts/commit/e65f8c21b9974dcccfa1c600a375d836acef4a7d
github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.3
github.com/highcharts/highcharts/security/advisories/GHSA-rcqf-f6h2-ccg9
nvd.nist.gov/vuln/detail/CVE-2026-118252

Code Behaviors & Features

Detect and mitigate CVE-2026-118252 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →