CVE-2026-118245

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-118245
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118245.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-118245
Aliases
Published
2026-10-28T17:44:51Z
Modified
2026-10-29T02:48:31Z
Severity
  • 8.6 (High) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
Details

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component container and chartOptions. An attacker who controls dashboard configuration can select a public utility function instead of a supported chart constructor, causing attacker-controlled options to be copied to the container as properties or attributes. Markup and event handlers can then execute in the hosting page origin when the board renders. No user interaction beyond rendering the board is required. This issue is fixed in 4.2.2.

Database specific 
{
    "cna_assigner":  "GitHub_M",
    "cwe_ids":  [
        "CWE-79"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118245.json"
}
References

Affected packages

Git / github.com/highcharts/highcharts

Affected ranges

Type
GIT
Repo
https://github.com/highcharts/highcharts
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
5d3e905ce2e2c75c174c06cf8dee0f00a5e02841
Introduced
ccdecb8282b7c857f6277b885c2657e4fb401f51
Fixed
1aacf2433fb94b1658300616fd442f82b774f9c5
Fixed
98d3652cdc4f66fbccbbb8b4184ecd8f647f74de
Fixed
a6d047d719460b0de3aa79adb032115dcdc79054
Database specific
Show details 
{
    "extracted_events":  [
        {
            "range":  [
                {
                    "introduced":  "0"
                },
                {
                    "fixed":  "13.1.0"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "introduced":  "1.0.0"
                },
                {
                    "fixed":  "4.2.3"
                }
            ],
            "source":  "AFFECTED_FIELD",
            "strategy":  "StringRangeExpression"
        },
        {
            "range":  [
                {
                    "fixed":  "98d3652cdc4f66fbccbbb8b4184ecd8f647f74de"
                }
            ],
            "source":  "REFERENCES_COMMIT"
        },
        {
            "original_tag":  "dashboards-v4.2.2",
            "range":  [
                {
                    "fixed":  "a6d047d719460b0de3aa79adb032115dcdc79054"
                }
            ],
            "source":  "REFERENCES_TAG"
        }
    ]
}

Affected versions

dashboards-v3.*
dashboards-v3.2.0
dashboards-v3.3.0
dashboards-v3.4.0
dashboards-v3.5.0
dashboards-v3.6.0
dashboards-v4.*
dashboards-v4.0.0
dashboards-v4.1.0
dashboards-v4.2.0
dashboards-v4.2.1
dashboards-v4.2.2
grid-v1.*
grid-v1.0.0
grid-v1.0.1
grid-v1.1.0
grid-v1.2.0
grid-v1.3.0
grid-v1.4.0
grid-v2.*
grid-v2.0.0
grid-v2.0.1
grid-v2.1.0
grid-v2.2.0
grid-v2.3.0
grid-v2.3.1
grid-v3.*
grid-v3.0.0
grid-v3.1.0
grid-v3.2.0
highmaps-v1.*
highmaps-v1.0.2
highmaps-v1.1.0
highmaps-v1.1.10
highmaps-v1.1.5
highmaps-v1.1.6
highmaps-v1.1.8
highmaps-v1.1.9
highmaps-v2.*
highmaps-v2.1.3
highstock-v1.*
highstock-v1.0.1
highstock-v1.1.0
highstock-v1.1.1
highstock-v1.1.2
highstock-v1.1.3
highstock-v1.1.4
highstock-v1.1.5
highstock-v1.1.6
highstock-v1.2.0
highstock-v1.2.2
highstock-v1.2.3
highstock-v1.2.4
highstock-v1.2.5
highstock-v1.3.0
highstock-v1.3.1
highstock-v1.3.2
highstock-v1.3.3
highstock-v1.3.4
highstock-v1.3.5
highstock-v1.3.8
highstock-v2.*
highstock-v2.0.1
highstock-v2.1.0
highstock-v2.1.10
highstock-v2.1.3
highstock-v2.1.5
highstock-v2.1.6
highstock-v2.1.8
highstock-v2.1.9
v12.*
v12.2.0
v12.3.0
v12.4.0
v12.5.0
v12.6.0
v13.*
v13.0.0
v13.0.1
v13.0.2
v2.*
v2.0.2
v2.0.3
v2.0.4
v2.0.5
v2.1.0
v2.1.1
v2.1.2
v2.1.3
v2.1.4
v2.1.5
v2.2.1
v2.2.2
v2.2.4
v2.2.5
v2.3.0
v2.3.2
v2.3.3
v2.3.5
v3.*
v3.0.0
v3.0.1
v3.0.2
v3.0.3
v3.0.4
v3.0.5
v3.0.8
v4.*
v4.0.1
v4.1.0
v4.1.10
v4.1.3
v4.1.5
v4.1.6
v4.1.8
v4.1.9
v4.2.0
v4.2.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118245.json"