CVE-2026-118242

A flaw was found in Highcharts. When rendering grid icons using Scalable Vector Graphics (SVG), the library copies configuration properties directly into element attributes without proper sanitization. An attacker who controls the grid configuration can supply malicious event handlers within custom icon definitions. When a user hovers over or activates an affected icon, arbitrary script executes within their browser session, potentially enabling sensitive information disclosure or unauthorized actions.

This vulnerability is rated as Moderate impact because successful exploitation requires an attacker to inject untrusted configuration objects into Highcharts Grid and relies on user interaction to execute script within the user's browser origin. In standard Red Hat product deployments, chart and grid configurations are not directly exposed to unauthenticated or untrusted input. Consequently, the practical risk is limited to applications where untrusted users can manipulate grid configuration structures without prior server-side sanitization.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.