Cpe:2.3:a:highcharts:highcharts_dashboards:*:*:*:*:*:*:*:* - CraftedSignal Threat Feedhttps://feed.craftedsignal.io/cpes/cpe2.3ahighchartshighcharts_dashboards/Trending threats, MITRE ATT&CK coverage, and detection metadata. Fed continuously.Hugoenhello@craftedsignal.iohello@craftedsignal.ioThu, 29 Oct 2026 06:13:04 +0000https://feed.craftedsignal.io/favicon-32x32.pngCraftedSignal Threat Feedhttps://feed.craftedsignal.io/3232https://feed.craftedsignal.io/favicon.svgHighcharts Dashboards: Cross-Site Scripting via Fullscreen Labelshttps://feed.craftedsignal.io/briefs/2026-10-highcharts-dashboards-xss/Thu, 29 Oct 2026 06:13:04 +0000hello@craftedsignal.iohttps://feed.craftedsignal.io/briefs/2026-10-highcharts-dashboards-xss/Highcharts Dashboards parses fullscreen labels as HTML, allowing an attacker who controls the Dashboards language options to execute script in the origin of the page hosting the dashboard.Highcharts Dashboards edit mode fullscreen labels are parsed as HTML when the corresponding control is rendered. If an attacker controls the Dashboards language options, they can supply markup carrying event handlers. These execute in the origin of the page hosting the dashboard, gaining access to page data, storage, and session state.

Impact

Successful exploitation allows script execution with the same access to page data, storage, and session state as the hosting application. Exploitation requires that untrusted data reach the Dashboards language configuration and that the affected control be rendered.

]]>highadvisoryxssweb-vulnerability