{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3ahighchartshighcharts_dashboards/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:highcharts:dashboards:*:*:*:*:*:*:*:*","cpe:2.3:a:highcharts:highcharts_dashboards:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-118253"},{"id":"CVE-2026-118252"}],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Highcharts Dashboards (vulnerable: \u003e= 1.0.0, \u003c 4.2.3)","Highcharts Dashboards (\u003e= 1.0.0, \u003c= 4.2.2)"],"_cs_severities":["high"],"_cs_tags":["xss","web-vulnerability"],"_cs_type":"advisory","_cs_vendors":["Highcharts"],"content_html":"\u003cp\u003eHighcharts Dashboards edit mode fullscreen labels are parsed as HTML when the corresponding control is rendered. If an attacker controls the Dashboards language options, they can supply markup carrying event handlers. These execute in the origin of the page hosting the dashboard, gaining access to page data, storage, and session state.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful exploitation allows script execution with the same access to page data, storage, and session state as the hosting application. Exploitation requires that untrusted data reach the Dashboards language configuration and that the affected control be rendered.\u003c/p\u003e\n","date_modified":"2026-10-29T19:49:22Z","date_published":"2026-10-29T06:13:04Z","id":"https://feed.craftedsignal.io/briefs/2026-10-highcharts-dashboards-xss/","summary":"Highcharts Dashboards parses fullscreen labels as HTML, allowing an attacker who controls the Dashboards language options to execute script in the origin of the page hosting the dashboard.","title":"Highcharts Dashboards: Cross-Site Scripting via Fullscreen Labels","url":"https://feed.craftedsignal.io/briefs/2026-10-highcharts-dashboards-xss/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:highcharts:highcharts_dashboards:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}