CVE-2026-118252Published
Highcharts Dashboards: sidebar component labels are parsed as HTML
Explicit identifiers and source references
These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.
CVE-2026-118252 · Microsoft / collected KEV context
cve-program · CVE-2026-118252
- https://github.com/highcharts/highcharts/security/advisories/GHSA-rcqf-f6h2-ccg9
- https://github.com/highcharts/highcharts/commit/e65f8c21b9974dcccfa1c600a375d836acef4a7d
- https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.3
euvd · EUVD-2026-112367
- https://github.com/highcharts/highcharts/security/advisories/GHSA-rcqf-f6h2-ccg9
- https://github.com/highcharts/highcharts/commit/e65f8c21b9974dcccfa1c600a375d836acef4a7d
- https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.3
nvd · CVE-2026-118252
- https://github.com/highcharts/highcharts/commit/e65f8c21b9974dcccfa1c600a375d836acef4a7d
- https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.3
- https://github.com/highcharts/highcharts/security/advisories/GHSA-rcqf-f6h2-ccg9
osv · GHSA-rcqf-f6h2-ccg9
Related operational evidence
Explicit CVE identifiers- Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboar… · Advisory content revised · 5 Nov 2026
- Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboar… · Advisory content revised · 3 Nov 2026
- Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboar… · Advisory content revised · 30 Oct 2026
- Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboar… · Advisory content revised · 30 Oct 2026
- Highcharts Dashboards: sidebar component labels are parsed as HTML · Newly collected advisory · 28 Oct 2026
- Highcharts Dashboards parses sidebar component labels as HTML · Newly collected advisory · 28 Oct 2026