Highcharts Dashboards: Cross-Site Scripting via Fullscreen Labels
Highcharts Dashboards parses fullscreen labels as HTML, allowing an attacker who controls the Dashboards language options to execute script in the origin of the page hosting the dashboard.
CVE search metadata
CVE search record: CVE-2026-118253. KEV: no. Product: Highcharts Dashboards (vulnerable: >= 1.0.0, < 4.2.3). Brief: Highcharts Dashboards: Cross-Site Scripting via Fullscreen Labels. Brief link: https://feed.craftedsignal.io/briefs/2026-10-highcharts-dashboards-xss/
Triage facts
Revision 1- Applicability
- Highcharts Dashboards (vulnerable: >= 1.0.0, < 4.2.3)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Oct 29, 06:13 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A1Likely
Highcharts Dashboards edit mode fullscreen labels are parsed as HTML when the corresponding control is rendered. If an attacker controls the Dashboards language options, they can supply markup carrying event handlers. These execute in the origin of the page hosting the dashboard, gaining access to page data, storage, and session state.
Impact
Successful exploitation allows script execution with the same access to page data, storage, and session state as the hosting application. Exploitation requires that untrusted data reach the Dashboards language configuration and that the affected control be rendered.