Highcharts Grid: `javascript:` URL in credits.href runs script on click

影響: npm:@highcharts/dashboards >= 3.2.0, <= 3.6.0 → 4.0.0, npm:@highcharts/grid-pro >= 2.0.0, <= 3.1.0 → 3.2.0

An attacker who controls the Grid configuration can set credits.href to a javascript: URL. The value is not validated against an allowed-scheme list before it is applied to the credits link, so activating that link runs attacker-supplied script in the origin of the page hosting the Grid. Exploitation requires that untrusted data reach the Grid configuration and that a user activate the credits link. Script running this way has the same access to page data, storage and session state as the hosti…

在 GitHub Advisory Database 阅读

2026/10/29 04:57，GitHub Advisory Database 发布了“Highcharts Grid: `javascript:` URL in credits.href runs script on click”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-118255。