CVE-2026-118255: Cross-Site Scripting via Unfiltered Credits Href in Highcharts Grid

Vulnerability ID: CVE-2026-118255
CVSS Score: 8.4
Published: 2026-10-28

CVE-2026-118255 is a Cross-Site Scripting (XSS) vulnerability in Highcharts Grid and Highcharts Grid Pro. The flaw occurs because the credits component assigns the configuration-supplied credits.href property directly to an HTML anchor element without verifying the URI scheme against the internal Abstract Syntax Tree (AST) allowlist. An attacker who can influence the grid configuration can supply a javascript: URI, resulting in arbitrary JavaScript execution in the victim's browser session when the credits link is clicked.

TL;DR

Highcharts Grid and Grid Pro fail to sanitize the credits.href configuration option before assigning it to a DOM anchor element. Supplying a javascript: pseudo-protocol URI enables Cross-Site Scripting (XSS) upon user interaction. Upgrade to @highcharts/grid-pro 3.2.0, @highcharts/dashboards 4.0.0, or highcharts 13.0.0-beta.2.

Technical Details

• Vulnerability Type: Cross-Site Scripting (CWE-79)
• CVSS v4.0 Score: 8.4 (High)
• Attack Vector: Network (Malicious Grid Configuration + User Click)
• Affected Component: Highcharts Grid & Grid Pro Credits (Credits.ts / CreditsPro.ts)
• Root Cause: Direct DOM setAttribute('href', ...) bypassing AST.filterUserAttributes()
• Impact: Arbitrary JavaScript execution in application origin
• Exploit Status: No known public exploitation
• CISA KEV Status: Not Listed

Affected Systems

• @highcharts/grid-pro
• @highcharts/dashboards
• highcharts
• @highcharts/grid-pro: >= 2.0.0, < 3.2.0 (Fixed in: 3.2.0)
• @highcharts/dashboards: >= 3.2.0, < 4.0.0 (Fixed in: 4.0.0)
• highcharts: < 13.0.0-beta.2 (Fixed in: 13.0.0-beta.2)

Code Analysis

Commit: 45b7440

Fixed credits href filtering in Grid and Grid Pro by routing href assignments through AST.filterUserAttributes.

diff --git a/ts/Grid/Core/Credits.ts b/ts/Grid/Core/Credits.ts
index 6bbe431cd00..07971c71625 100644
--- a/ts/Grid/Core/Credits.ts
+++ b/ts/Grid/Core/Credits.ts
@@ -26,6 +26,7 @@
 import type { CreditsOptions } from './Options';
 import type Grid from './Grid';

+import AST from '../../Core/Renderer/HTML/AST.js';
 import Globals from './Globals.js';
 import GridUtils from './GridUtils.js';

@@ -142,7 +143,7 @@ class Credits {
             setHTMLContent(this.textElement, text);
         }
         if (href) {
-            this.textElement.setAttribute('href', href || '');
+            this.setHref(href);
         }

         if (grid.descriptionElement) {
@@ -155,6 +156,23 @@ class Credits {
         }
     }

+    /**
+     * Set the anchor's href, dropping URLs that are not allowed references.
+     *
+     * @param href
+     * The href to set on the anchor element. If undefined or unsafe, the href
+     * attribute will be removed.
+     */
+    protected setHref(href?: string): void {
+        const filtered = href && AST.filterUserAttributes({ href }).href;
+
+        if (filtered) {
+            this.textElement.setAttribute('href', filtered);
+        } else {
+            this.textElement.removeAttribute('href');
+        }
+    }
+
     private renderAnchor(): HTMLElement {
         const anchorElement = makeHTMLElement<HTMLAnchorElement>('a', {
             className: Globals.getClassName('creditsText')
diff --git a/ts/Grid/Pro/Credits/CreditsPro.ts b/ts/Grid/Pro/Credits/CreditsPro.ts
index e703bbb4959..a0e821f7ec0 100644
--- a/ts/Grid/Pro/Credits/CreditsPro.ts
+++ b/ts/Grid/Pro/Credits/CreditsPro.ts
@@ -54,7 +54,7 @@ class CreditsPro extends Credits {
         const { text, href } = this.options;

         setHTMLContent(this.textElement, text || '');
-        this.textElement.setAttribute('href', href || '');
+        this.setHref(href);
     }

Mitigation Strategies

• Upgrade Highcharts packages (@highcharts/grid-pro, @highcharts/dashboards, and highcharts) to patched releases that enforce AST.filterUserAttributes on credits.href.
• Enforce a strict Content Security Policy (CSP) that omits 'unsafe-inline' from the script-src directive to prevent browser execution of javascript: pseudo-protocol URIs.
• Sanitize user-supplied or database-stored grid configuration objects prior to initialization by validating credits.href against an explicit allowlist of safe schemes (https:, http:) or disabling credits entirely.

Remediation Steps:

1. Audit application package manifests (package.json, package-lock.json, yarn.lock) for @highcharts/grid-pro (< 3.2.0), @highcharts/dashboards (>= 3.2.0, < 4.0.0), and highcharts (< 13.0.0-beta.2).
2. Run npm install @highcharts/grid-pro@^3.2.0 or update @highcharts/dashboards to ^4.0.0 depending on the packages used.
3. If immediate upgrading is blocked, implement a pre-render hook that deletes options.credits.href or forces options.credits = { enabled: false } on all untrusted grid configurations.
4. Verify the fix by passing { credits: { href: 'javascript:alert(1)' } } to a test grid instance and confirming that the rendered element does not contain an href attribute.

References

• GitHub Security Advisory GHSA-6hgp-fmhr-mrg4
• Highcharts Fix Commit 45b74403acafbe9f621c4a343506721d9129e991
• Highcharts Pull Request #25351
• Highcharts Grid v3.2.0 Release
• CVE.org Record: CVE-2026-118255
• NVD Detail: CVE-2026-118255
• MITRE ATT&CK Search for CVE-2026-118255

Read the full report for CVE-2026-118255 on our website for more details including interactive diagrams and full exploit analysis.