Highcharts Dashboards: sidebar component labels are parsed as HTML

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboards language configuration can provide markup containing event handlers, which execute in the hosting page origin when a user opens the edit-mode sidebar and the affected labels render. This issue is fixed in 4.2.3.

Etkilenen sürümler2 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…charts/security/advisories/GHSA-rcqf-f6h2-ccg9 Diğer
• github.com/…ommit/e65f8c21b9974dcccfa1c600a375d836acef4a7d Diğer
• github.com/…arts/highcharts/releases/tag/dashboards-v4.2.3 Diğer

Kayıt geçmişi

1. 28 Eki 2026 21:08Yayımlandı

İlgili açıklar

• 8,4 CVE-2026-118255Highcharts Grid: javascript: URL in credits.href runs script on click
• 8,6 CVE-2026-118254Highcharts Grid: pagination language options are parsed as HTML
• 8,4 CVE-2026-118253Highcharts Dashboards: fullscreen labels are parsed as HTML
• 8,4 CVE-2026-118251Highcharts: javascript: URL in credits.href runs script on click
• 7,2 CVE-2026-118250Highcharts: dotted series.keys paths write to Object.prototype
• 7,2 CVE-2026-118249Highcharts: series column construction writes to Object.prototype