Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

CISA KEV is observed exploitation evidence. FIRST EPSS is a dated prediction of exploitation in the next 30 days. Missing scores are unknown. This collector requests predictions only for explicit CVE aliases in the public NuGet archive; Microsoft release views retain their existing prediction scope.

No collected risk observation for these identifiers. This does not establish absence of exploitation or a zero probability.

Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.

Source published

28 Oct 2026 17:30:55 UTC

Source modified

3 Nov 2026 13:11:25 UTC

Observed here

3 Nov 2026 14:57:17 UTC

Source terms

CVE Program Terms of Use

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: cve-program · CVE Program Terms of Use. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.

Source published

Oct 28, 2026, 5:30:55 PM (timezone not stated)

Source modified

Nov 3, 2026, 1:11:25 PM (timezone not stated)

Observed here

6 Nov 2026 00:43:21 UTC

Source terms

ENISA EUVD · source terms and attribution apply

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: euvd · ENISA EUVD · source terms and attribution apply. Source text is retained; field grouping and change labels are provided by ChangeIntel.

EUVD CVSS 4.0 · 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.

Source published

28 Oct 2026 18:17:14 UTC

Source modified

3 Nov 2026 13:17:20 UTC

Observed here

5 Nov 2026 23:38:43 UTC

Source terms

NIST NVD usage terms; underlying source attribution retained

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: nvd · NIST NVD usage terms; underlying source attribution retained. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS 4.0 · [email protected] · Secondary · 8.5 CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

### Impact A custom icon supplied under `rendering.icons` as an icon definition object is built by creating an SVG path for each of its child entries and setting every key of that entry as an attribute of the path, without filtering the attribute names; only the string form of the option is passed through the markup allow-list. An attacker who controls the Grid configuration can therefore supply child entries whose keys name event handlers, and those handlers execute in the origin of the page hosting the Grid. Custom icons take precedence over the built-in ones, so the attacker can replace icons that render without any further configuration, such as the sort icon shown in every column header by default and the pagination controls where pagination is enabled, and does not need any reference to a custom icon name. Exploitation requires that untrusted data reach the Grid configuration and that a user hover over or activate an affected icon. ### Workarounds If your Grid configuration comes from a source you do not fully control, paste this snippet right after importing the Grid module: ```ts (function () { const GridNS = typeof Grid !== 'undefined' ? Grid : undefined; const GridClass = GridNS && GridNS.Grid; if (!GridClass || !GridClass.prototype.loadUserOptions) { return; // Grid not loaded } const allowedPathAttributes = [ 'd', 'fill', 'opacity', 'stroke', 'stroke-width', 'stroke-linecap', 'stroke-linejoin', 'transform' ]; const originalLoadUserOptions = GridClass.prototype.loadUserOptions; function sanitizeIconValue(value) { if (!value || typeof value === 'string') { return value; } const children = value.children || []; const sanitizedChildren = []; for (let i = 0; i < children.length; i++) { const child = children[i] || {}; const clean = {}; for (let j = 0; j < allowedPathAttributes.length; j++) { const attr = allowedPathAttributes[j]; if (child[attr] !== undefined && child[attr] !== null) { clean[attr] = child[attr]; } } sanitizedChildren.push(clean); } return { width: value.width, height: value.height, viewBox: value.viewBox, fill: value.fill, children: sanitizedChildren }; } function sanitizeIconsMap(icons) { if (!icons) { return icons; } const out = {}; for (const key in icons) { if (Object.prototype.hasOwnProperty.call(icons, key)) { out[key] = sanitizeIconValue(icons[key]); } } return out; } GridClass.prototype.loadUserOptions = function (newOptions) { if ( newOptions && newOptions.rendering && newOptions.rendering.icons ) { newOptions.rendering.icons = sanitizeIconsMap( newOptions.rendering.icons ); } return originalLoadUserOptions.apply(this, arguments); }; }()); ``` ### Obtaining the patched version The patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install @highcharts/[email protected]`. If you load Highcharts Grid from a CDN, use a versioned URL, for example `https://cdn.jsdelivr.net/npm/@highcharts/[email protected]/grid-lite.js`. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/grid/installation).

Source published

28 Oct 2026 19:55:46 UTC

Source modified

28 Oct 2026 20:15:06 UTC

Observed here

28 Oct 2026 20:55:42 UTC

Source terms

GitHub Advisory Database · CC-BY-4.0

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · GitHub Advisory Database · CC-BY-4.0. Source text is retained; field grouping and change labels are provided by ChangeIntel.

CVSS_V4 · CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N

Publisher rating · HIGH