Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Highcharts JS is a JavaScript charting library based on SVG. From 2.3.0 until 3.2.0, Highcharts Grid creates SVG path elements from rendering.icons object definitions and previously copied every child key with setAttribute. An attacker who controls Grid configuration can supply event-handler attribute names in an icon definition. Because custom icons override built-ins, the attacker can replace default sort or pagination icons, and script runs in the hosting page origin when a user hovers over or activates the affected icon. This issue is fixed in 3.2.0.

Etkilenen sürümler3 yazılım

Kaynaklar4 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…charts/security/advisories/GHSA-6g3c-p4fg-xv47 Diğer
• github.com/…ommit/8fc970658fee6601625b42da29d27c3ef7c45e30 Diğer

Kayıt geçmişi

1. 28 Eki 2026 20:30Yayımlandı

İlgili açıklar

• 8,4 CVE-2026-118255Highcharts Grid: javascript: URL in credits.href runs script on click
• 8,6 CVE-2026-118254Highcharts Grid: pagination language options are parsed as HTML
• 8,4 CVE-2026-118253Highcharts Dashboards: fullscreen labels are parsed as HTML
• 8,4 CVE-2026-118252Highcharts Dashboards: sidebar component labels are parsed as HTML
• 8,4 CVE-2026-118251Highcharts: javascript: URL in credits.href runs script on click
• 7,2 CVE-2026-118250Highcharts: dotted series.keys paths write to Object.prototype