CVE-2026-118254: CVE-2026-118254: DOM-based Cross-Site Scripting in Highcharts Grid Pagination Module

CVE-2026-118254 represents a high-severity (CVSS 8.6) DOM-based Cross-Site Scripting (XSS) vulnerability found in the pagination module of Highcharts Grid versions 2.0.0 prior to 3.2.0. The flaw arises from the direct assignment of localization strings (lang.pageInfo and lang.pageSizeLabel) and pagination UI labels to DOM elements using the innerHTML property. This allows arbitrary HTML and JavaScript to execute when attacker-controlled data is passed through the Grid localization options with pagination enabled.

The vulnerability stems from the use of innerHTML instead of safer DOM APIs like innerText or textContent. When an application passes unvalidated user data into these localization options, the XSS payload executes automatically upon rendering the affected component. The CVE ID is CVE-2026-118254 (GHSA-r5wg-q8fc-p6w2), and the affected components are @highcharts/grid-lite and @highcharts/grid-pro packages.

Upgrading to version 3.2.0 or higher resolves the issue. The POC technical details, CVSS score, and remediation strategies are detailed in the original CVE report.