{"id":"ghsa-ghsa-6hgp-fmhr-mrg4","seq":2056971,"kind":"advisory","title":"Highcharts Grid: `javascript:` URL in credits.href runs script on click","url":"https://github.com/advisories/GHSA-6hgp-fmhr-mrg4","permalink":"https://vulnpulse.app/items/ghsa-ghsa-6hgp-fmhr-mrg4","summary":"影響: npm:@highcharts/dashboards >= 3.2.0, <= 3.6.0 → 4.0.0, npm:@highcharts/grid-pro >= 2.0.0, <= 3.1.0 → 3.2.0\nAn attacker who controls the Grid configuration can set credits.href to a javascript: URL. The value is not validated against an allowed-scheme list before it is applied to the credits link, so activating that link runs attacker-supplied script in the origin of the page hosting the Grid. Exploitation requires that untrusted data reach the Grid configuration and that a user activate the credits link. Script running this way has the same access to page data, storage and session state as the hosti…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-118255"],"tags":["GHSA-6hgp-fmhr-mrg4","@highcharts/dashboards","@highcharts/grid-pro"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:57:48.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}