CVE-2026-118254: CVE-2026-118254: DOM-based Cross-Site Scripting in Highcharts Grid Pagination Module

#security #cve #cybersecurity

CVE-2026-118254: DOM-based Cross-Site Scripting in Highcharts Grid Pagination Module

Vulnerability ID: CVE-2026-118254
CVSS Score: 8.6
Published: 2026-10-28

CVE-2026-118254 (GHSA-r5wg-q8fc-p6w2) is a high-severity DOM-based Cross-Site Scripting (DOM XSS) vulnerability in the pagination module of Highcharts Grid (@highcharts/grid-lite and @highcharts/grid-pro). The flaw stems from the direct assignment of localization configuration strings (lang.pageInfo and lang.pageSizeLabel) and pagination UI labels to DOM elements via the innerHTML property instead of text-safe DOM APIs such as textContent or innerText. When an application passes attacker-controlled data into the Grid localization options with pagination enabled, arbitrary HTML and JavaScript execute automatically within the hosting document's origin context upon component rendering.

TL;DR

Highcharts Grid versions 2.0.0 prior to 3.2.0 are vulnerable to DOM-based Cross-Site Scripting (CWE-79) in the Pagination module due to unsafe innerHTML assignments of lang.pageInfo and lang.pageSizeLabel configuration properties. Upgrading @highcharts/grid-lite and @highcharts/grid-pro to version 3.2.0 remediates the issue.

⚠️ Exploit Status: POC

Technical Details

CVE ID: CVE-2026-118254 (GHSA-r5wg-q8fc-p6w2)
Vulnerability Class: CWE-79: DOM-based Cross-Site Scripting (DOM XSS)
CVSS v4.0 Score: 8.6 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N)
Affected Component: ts/Grid/Core/Pagination/Pagination.ts (@highcharts/grid-lite & @highcharts/grid-pro)
Vulnerable Versions: >= 2.0.0, < 3.2.0 (Grid) | < 13.0.0-beta.2 (Highcharts Core)
Patched Version: 3.2.0
User Interaction: None (Triggers automatically on Pagination component render)
CISA KEV Status: Not Listed

Affected Systems

@highcharts/grid-lite (npm)
@highcharts/grid-pro (npm)
highcharts (Highcharts JS Core)
@highcharts/grid-lite: >= 2.0.0, < 3.2.0 (Fixed in: 3.2.0)
@highcharts/grid-pro: >= 2.0.0, < 3.2.0 (Fixed in: 3.2.0)
highcharts: < 13.0.0-beta.2 (Fixed in: 13.0.0-beta.2)

Code Analysis

Commit: 1e8ded8

Fixed XSS in Pagination lang sinks.

File: ts/Grid/Core/Pagination/Pagination.ts
@@ -490,7 +490,7 @@ class Pagination {
             totalPages: totalPages
         });

-        this.pageInfoElement.innerHTML = pageInfoText;
+        this.pageInfoElement.textContent = pageInfoText;
     }

     /**
@@ -924,7 +924,7 @@ class Pagination {

         const button = makeHTMLElement('button', {
             className: Globals.getClassName('button'),
-            innerHTML: pageNumber.toString()
+            innerText: pageNumber.toString()
         }, this.pageNumbersContainer);

         if (isActive) {
@@ -958,7 +958,7 @@ class Pagination {
         }

         const ellipsisElement = makeHTMLElement('span', {
-            innerHTML: '...'
+            innerText: '...'
         }, this.pageNumbersContainer);
         ellipsisElement.title = this.lang?.ellipsis ?? '';

@@ -990,7 +990,7 @@ class Pagination {
         }, this.contentWrapper);

         makeHTMLElement('span', {
-            innerHTML: this.lang?.pageSizeLabel ?? ''
+            innerText: this.lang?.pageSizeLabel ?? ''
         }, container);

         this.pageSizeSelect = makeHTMLElement('select', {
@@ -1001,7 +1001,7 @@ class Pagination {
         this.pageSizeSelectorOptions.forEach((option: number): void => {
             const optionElement = document.createElement('option');
             optionElement.value = option.toString();
-            optionElement.innerHTML = option.toString();
+            optionElement.textContent = option.toString();

             if (option === this.controller.currentPageSize) {
                 optionElement.selected = true;

Mitigation Strategies

Upgrade @highcharts/grid-lite and @highcharts/grid-pro packages to version 3.2.0 or higher.
Apply the runtime prototype monkey-patch to Pagination.prototype.updatePageInfo and Pagination.prototype.renderPageSizeSelector if immediate package upgrades are not possible.
Sanitize or HTML-encode any user-controllable strings before passing them into Highcharts Grid lang configuration properties.
Enforce a strict Content Security Policy (CSP) that disallows unsafe-inline script execution to prevent inline event handler payloads from executing.

Remediation Steps:

Audit application package manifests (package.json, package-lock.json, yarn.lock) for @highcharts/grid-lite and @highcharts/grid-pro versions between 2.0.0 and 3.1.x.
Run 'npm install @highcharts/grid-lite@3.2.0' or 'npm install @highcharts/grid-pro@3.2.0' (or update CDN script URLs to version 3.2.0).
Verify that custom localization dictionaries passed to Grid instances do not rely on raw HTML markup inside lang.pageInfo or lang.pageSizeLabel, as version 3.2.0 renders these strictly as plain text.
Rebuild and redeploy the frontend bundle.

References

Read the full report for CVE-2026-118254 on our website for more details including interactive diagrams and full exploit analysis.

DEV Community