Highcharts Grid: `javascript:` URL in credits.href runs script on click
影響: npm:@highcharts/dashboards >= 3.2.0, <= 3.6.0 → 4.0.0, npm:@highcharts/grid-pro >= 2.0.0, <= 3.1.0 → 3.2.0
An attacker who controls the Grid configuration can set credits.href to a javascript: URL. The value is not validated against an allowed-scheme list before it is applied to the credits link, so activating that link runs attacker-supplied script in the origin of the page hosting the Grid. Exploitation requires that untrusted data reach the Grid configuration and that a user activate the credits link. Script running this way has the same access to page data, storage and session state as the hosti…
| CVE | CVE-2026-118255 |
|---|---|
| 정보원 | GitHub Advisory Database |
| 수집 시각 | 2026. 10. 29. 오전 09:48 |
| 데이터 | Markdown JSON |
2026. 10. 29. 오전 04:57, GitHub Advisory Database에서 "Highcharts Grid: `javascript:` URL in credits.href runs script on click"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-118255.