{
  "id": 16961522,
  "title": "CVE-2026-118254: CVE-2026-118254: DOM-based Cross-Site Scripting in Highcharts Grid Pagination Module",
  "url": "https://urgent.news/2026/10/28/cve-2026-118254-cve-2026-118254-dom-based-cross-site-scripting-in",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-10-28T21:30:49.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/cverports/cve-2026-118254-cve-2026-118254-dom-based-cross-site-scripting-in-highcharts-grid-pagination-3dj2"
  },
  "original_language": "en",
  "account": "CVE-2026-118254 represents a high-severity (CVSS 8.6) DOM-based Cross-Site Scripting (XSS) vulnerability found in the pagination module of Highcharts Grid versions 2.0.0 prior to 3.2.0. The flaw arises from the direct assignment of localization strings (lang.pageInfo and lang.pageSizeLabel) and pagination UI labels to DOM elements using the innerHTML property. This allows arbitrary HTML and JavaScript to execute when attacker-controlled data is passed through the Grid localization options with pagination enabled.\n\nThe vulnerability stems from the use of innerHTML instead of safer DOM APIs like innerText or textContent. When an application passes unvalidated user data into these localization options, the XSS payload executes automatically upon rendering the affected component. The CVE ID is CVE-2026-118254 (GHSA-r5wg-q8fc-p6w2), and the affected components are @highcharts/grid-lite and @highcharts/grid-pro packages. Upgrading to version 3.2.0 or higher resolves the issue. The POC technical details, CVSS score, and remediation strategies are detailed in the original CVE report.",
  "summary": "CVE-2026-118254: DOM-based Cross-Site Scripting in Highcharts Grid Pagination Module Vulnerability ID: CVE-2026-118254 CVSS Score: 8.6 Published: 2026-10-28 CVE-2026-118254 (GHSA-r5wg-q8fc-p6w2) is a high-severity DOM-based Cross-Site Scripting (DOM XSS) vulnerability in the pagination module of Highcharts Grid (@highcharts/grid-lite and @highcharts/grid-pro). The flaw stems from the direct…",
  "key_points": [
    "Highcharts Grid versions 2.0.0 to 3.1.0 vulnerable to DOM-based XSS",
    "innerHTML used instead of innerText or textContent in pagination module",
    "Upgrade to version 3.2.0 or higher to resolve the issue"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}