CVE-2026-118255: Highcharts Grid: `javascript:` URL in credits.href runs script on click
An attacker who controls the Grid configuration can set credits.href to a javascript: URL. The value is not validated against an allowed-scheme list before it is applied to the credits link, so activating that link runs attacker-supplied script in the origin of the page hosting the Grid. Exploitation requires that untrusted data reach the Grid configuration and that a user activate the credits link. Script running this way has the same access to page data, storage and session state as the hosting application.
References
- github.com/advisories/GHSA-6hgp-fmhr-mrg4
- github.com/highcharts/highcharts/commit/45b74403acafbe9f621c4a343506721d9129e991
- github.com/highcharts/highcharts/pull/25351
- github.com/highcharts/highcharts/releases/tag/grid-v3.2.0
- github.com/highcharts/highcharts/security/advisories/GHSA-6hgp-fmhr-mrg4
- nvd.nist.gov/vuln/detail/CVE-2026-118255
Code Behaviors & Features
Detect and mitigate CVE-2026-118255 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →