Highcharts Grid: pagination language options are parsed as HTML

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid writes pagination language strings into the DOM as markup instead of text. An attacker who controls the Grid language configuration can provide elements with event handlers, which execute in the hosting page origin when pagination controls render. Exploitation requires pagination to be enabled but does not require additional user interaction. This issue is fixed in 3.2.0.

Etkilenen sürümler3 yazılım

Kaynaklar5 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…charts/security/advisories/GHSA-r5wg-q8fc-p6w2 Diğer
• github.com/…ommit/1e8ded84d52191883965641b863cf0c73eb759aa Diğer
• github.com/highcharts/highcharts/releases/tag/grid-v3.2.0 Diğer

Kayıt geçmişi

1. 28 Eki 2026 21:13Yayımlandı

İlgili açıklar

• 8,4 CVE-2026-118255Highcharts Grid: javascript: URL in credits.href runs script on click
• 8,4 CVE-2026-118253Highcharts Dashboards: fullscreen labels are parsed as HTML
• 8,4 CVE-2026-118252Highcharts Dashboards: sidebar component labels are parsed as HTML
• 8,4 CVE-2026-118251Highcharts: javascript: URL in credits.href runs script on click
• 7,2 CVE-2026-118250Highcharts: dotted series.keys paths write to Object.prototype
• 7,2 CVE-2026-118249Highcharts: series column construction writes to Object.prototype