CVE-2026-118242

Highcharts Grid: custom icon definition objects written with raw setAttribute on <path>

(function () {
    const GridNS = typeof Grid !== 'undefined' ? Grid : undefined;
    const GridClass = GridNS && GridNS.Grid;

    if (!GridClass || !GridClass.prototype.loadUserOptions) {
        return; // Grid not loaded
    }

    const allowedPathAttributes = [
        'd',
        'fill',
        'opacity',
        'stroke',
        'stroke-width',
        'stroke-linecap',
        'stroke-linejoin',
        'transform'
    ];

    const originalLoadUserOptions = GridClass.prototype.loadUserOptions;

    function sanitizeIconValue(value) {
        if (!value || typeof value === 'string') {
            return value;
        }

        const children = value.children || [];
        const sanitizedChildren = [];

        for (let i = 0; i < children.length; i++) {
            const child = children[i] || {};
            const clean = {};

            for (let j = 0; j < allowedPathAttributes.length; j++) {
                const attr = allowedPathAttributes[j];
                if (child[attr] !== undefined && child[attr] !== null) {
                    clean[attr] = child[attr];
                }
            }

            sanitizedChildren.push(clean);
        }

        return {
            width: value.width,
            height: value.height,
            viewBox: value.viewBox,
            fill: value.fill,
            children: sanitizedChildren
        };
    }

    function sanitizeIconsMap(icons) {
        if (!icons) {
            return icons;
        }

        const out = {};
        for (const key in icons) {
            if (Object.prototype.hasOwnProperty.call(icons, key)) {
                out[key] = sanitizeIconValue(icons[key]);
            }
        }
        return out;
    }

    GridClass.prototype.loadUserOptions = function (newOptions) {
        if (
            newOptions &&
            newOptions.rendering &&
            newOptions.rendering.icons
        ) {
            newOptions.rendering.icons = sanitizeIconsMap(
                newOptions.rendering.icons
            );
        }

        return originalLoadUserOptions.apply(this, arguments);
    };
}());

A custom icon supplied under rendering.icons as an icon definition object is built by creating an SVG path for each of its child entries and setting every key of that entry as an attribute of the path, without filtering the attribute names; only the string form of the option is passed through the markup allow-list. An attacker who controls the Grid configuration can therefore supply child entries whose keys name event handlers, and those handlers execute in the origin of the page hosting the Grid. Custom icons take precedence over the built-in ones, so the attacker can replace icons that render without any further configuration, such as the sort icon shown in every column header by default and the pagination controls where pagination is enabled, and does not need any reference to a custom icon name. Exploitation requires that untrusted data reach the Grid configuration and that a user hover over or activate an affected icon.

Untrusted input is rendered as active markup in a victim's browser, which can run script in their session. Typical impact: session or credential theft, and actions taken as the user.

Kodem intelligence

Already deployed Kodem?

1. What is CVE-2026-118242? CVE-2026-118242 is a high-severity cross-site scripting (XSS) vulnerability in @highcharts/grid-lite (npm), affecting versions >= 2.3.0, <= 3.1.0. It is fixed in 3.2.0. Untrusted input is rendered as active markup in a victim's browser, which can run script in their session.
2. Which packages are affected by CVE-2026-118242?
   • @highcharts/grid-lite (npm) (versions >= 2.3.0, <= 3.1.0)
   • @highcharts/grid-pro (npm) (versions >= 2.3.0, <= 3.1.0)
3. Is there a fix for CVE-2026-118242? Yes. CVE-2026-118242 is fixed in 3.2.0. Upgrade to this version or later.
4. Is CVE-2026-118242 exploitable, and should I be worried? Whether CVE-2026-118242 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-118242 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-118242?
   • Upgrade @highcharts/grid-lite to 3.2.0 or later
   • Upgrade @highcharts/grid-pro to 3.2.0 or later

Other vulnerabilities in @highcharts/grid-lite