Highcharts Grid: javascript: URL in credits.href runs script on click

Özet

Türkçe özeti henüz hazır değil; şimdilik kaynağın kendi açıklamasını gösteriyoruz.

Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a javascript URL, and activating the credits link runs script in the origin of the hosting page with access to that application's data and session state.This issue is fixed in Grid Pro 3.2.0.

Etkilenen sürümler3 yazılım

Kaynaklar6 kaynak

• CVE.org kaydı
• NVD kaydı
• github.com/…charts/security/advisories/GHSA-6hgp-fmhr-mrg4 Diğer
• github.com/highcharts/highcharts/pull/25351 Diğer
• github.com/…ommit/45b74403acafbe9f621c4a343506721d9129e991 Diğer
• github.com/highcharts/highcharts/releases/tag/grid-v3.2.0 Diğer

Kayıt geçmişi

1. 28 Eki 2026 21:17Yayımlandı

İlgili açıklar

• 8,6 CVE-2026-118254Highcharts Grid: pagination language options are parsed as HTML
• 8,4 CVE-2026-118253Highcharts Dashboards: fullscreen labels are parsed as HTML
• 8,4 CVE-2026-118252Highcharts Dashboards: sidebar component labels are parsed as HTML
• 8,4 CVE-2026-118251Highcharts: javascript: URL in credits.href runs script on click
• 7,2 CVE-2026-118250Highcharts: dotted series.keys paths write to Object.prototype
• 7,2 CVE-2026-118249Highcharts: series column construction writes to Object.prototype