@highcharts/grid-pro vulnerabilities
CVEs whose affected-version data names the @highcharts/grid-pro package (npm). Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
5 CVEsRSS
CVE-2026-118255HighHighcharts Grid: `javascript:` URL in credits.href runs script on click
Highcharts Grid: `javascript:` URL in credits.href runs script on click
▾ Twilighthighcharts · @highcharts/dashboardsvia GHSA
CVE-2026-118254High· 8.6Highcharts Grid parses pagination language options as HTML
Highcharts Grid parses pagination language options as HTML
▾ Twilighthighcharts · @highcharts/grid-litevia GHSA
CVE-2026-116797High· 8.5Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
▾ Twilighthighcharts · @highcharts/grid-provia GHSA
CVE-2026-118242High· 8.5Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
▾ Twilighthighcharts · @highcharts/grid-litevia GHSA
CVE-2026-118247Medium· 6.9Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
▾ Sunlithighcharts · @highcharts/dashboardsvia GHSA