highcharts has 16 CVEs on record. Disclosure cadence is accelerating: 16 in the last 90 days against 0 in the 90 before. The busiest recent month was October 2026 with 16. The median CVSS is 8.4 (high). None have a confirmed exploitation report. The dominant weakness classes are CWE-79 (11) and CWE-1321 (5). Most affected products: highcharts (7), @highcharts/dashboards (6), @highcharts/grid-lite (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 8.4
- Publish → KEV
- —
- Last 90 days
- 16 prev 0
Weakness classes
Products
- highcharts 7
- @highcharts/dashboards 6
- @highcharts/grid-lite 2
- @highcharts/grid-pro 1
Worst active — by depth score
CVE-2026-118254High· 8.6Highcharts Grid parses pagination language options as HTML47CVE-2026-118245High· 8.6Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace47CVE-2026-118242High· 8.5Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`47CVE-2026-116797High· 8.5Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`47CVE-2026-118253High· 8.4Highcharts Dashboards parses fullscreen labels as HTML46
highcharts vulnerabilities
CVEs affecting highcharts, newest first. Open any entry for full detail, references, and exploit status.
16 CVEsRSS
CVE-2026-118253High· 8.4Highcharts Dashboards parses fullscreen labels as HTML
Highcharts Dashboards parses fullscreen labels as HTML
CVE-2026-118255HighHighcharts Grid: `javascript:` URL in credits.href runs script on click
Highcharts Grid: `javascript:` URL in credits.href runs script on click
CVE-2026-118254High· 8.6Highcharts Grid parses pagination language options as HTML
Highcharts Grid parses pagination language options as HTML
CVE-2026-118252High· 8.4Highcharts Dashboards parses sidebar component labels as HTML
Highcharts Dashboards parses sidebar component labels as HTML
CVE-2026-118251High· 8.4Highcharts: `javascript:` URL in credits.href runs script on click
Highcharts: `javascript:` URL in credits.href runs script on click
CVE-2026-116796High· 7.2Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts
CVE-2026-116797High· 8.5Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
CVE-2026-118242High· 8.5Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`
CVE-2026-118243Medium· 5.3Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`
CVE-2026-118244High· 7.2Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing
Highcharts Core: HTML text parsing falls back to unfiltered `innerHTML` during printing
CVE-2026-118246High· 8.4Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
CVE-2026-118245High· 8.6Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace
CVE-2026-118247Medium· 6.9Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.
CVE-2026-118249High· 7.2Highcharts: series column construction writes to Object.prototype
Highcharts: series column construction writes to Object.prototype
CVE-2026-118248Medium· 6.9Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableO…
CVE-2026-118250High· 7.2Highcharts: dotted series.keys paths write to Object.prototype
Highcharts: dotted series.keys paths write to Object.prototype