@highcharts/dashboards
npm7 known CVEs affecting this package
Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.
CVEs affecting @highcharts/dashboardspage 1 of 1
- CVE-2026-116797HIGHCVSS 8.5EG 8.5fixed in 4.0.02026-10-28
vulnerable: 3.6.0
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid Pro input renderers copy the cells.renderer.attributes and cells.editMode.renderer.attributes maps to input or select elements with raw se…
- CVE-2026-118243MEDIUMCVSS 5.3EG 5.3fixed in 4.2.22026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool con…
- CVE-2026-118245HIGHCVSS 8.6EG 8.6fixed in 4.2.22026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards uses chartConstructor as an unchecked property lookup in the Highcharts namespace and invokes the selected member with the component…
- CVE-2026-118247MEDIUMCVSS 6.9EG 6.9fixed in 4.2.22026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ o…
- CVE-2026-118252HIGHCVSS 8.4EG 8.4fixed in 4.2.32026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit-mode sidebar parses component language strings as HTML rather than inserting them as text. An attacker who controls the Dashboa…
- CVE-2026-118253HIGHCVSS 8.4EG 8.4fixed in 4.2.32026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.3, Highcharts Dashboards edit mode parses fullscreen language labels as HTML rather than inserting them as text. An attacker who controls Dashboards language…
- CVE-2026-118255HIGHCVSS 8.4EG 8.4fixed in 4.0.02026-10-28
Highcharts JS is a JavaScript charting library based on SVG. From 2.0.0 until 3.2.0, Highcharts Grid applies credits.href to the credits link without validating the URL scheme. An attacker who controls Grid configuration can provide a java…
Check whether @highcharts/dashboards is used in your infrastructure
EchelonGraph scans your cloud and SBOMs to map every package to your actual deployments. See blast radius for @highcharts/dashboards CVEs against the assets you own.
Book a Demo →