@highcharts/dashboards vulnerabilities
CVEs whose affected-version data names the @highcharts/dashboards package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
7 CVEsRSS
CVE-2026-118253High· 8.4Highcharts Dashboards parses fullscreen labels as HTML
Highcharts Dashboards parses fullscreen labels as HTML
CVE-2026-118255HighHighcharts Grid: `javascript:` URL in credits.href runs script on click
Highcharts Grid: `javascript:` URL in credits.href runs script on click
CVE-2026-118252High· 8.4Highcharts Dashboards parses sidebar component labels as HTML
Highcharts Dashboards parses sidebar component labels as HTML
CVE-2026-116797High· 8.5Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
CVE-2026-118243Medium· 5.3Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
CVE-2026-118245High· 8.6Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
CVE-2026-118247Medium· 6.9Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.