The vulnerability occurs in Highcharts Dashboards versions 1.0.0 through 4.2.2, allowing an attacker-controlled dashboard configuration to specify any property name resolved on the Highcharts namespace. The unchecked lookup executes an arbitrary public utility function with the specified component container and chart options. The function can copy attacker‑controlled options to the container as DOM attributes or inject inline markup and event handlers that are executed in the host page’s origin when the dashboard renders. The result is a cross‑site scripting condition that can run arbitrary JavaScript on the page without requiring user interaction beyond rendering, allowing attackers to hijack sessions, steal data, or deface content.

The flaw affects the Highcharts Dashboards component and the core Highcharts library, specifically the namespace lookup mechanism available from version 1.0.0 up to 4.2.2. End‑users running any web application that includes @highcharts/dashboards or highcharts/highcharts before the 4.2.2 release are exposed. The issue was introduced with the chartConstructor module and was patched in dashboards‑v4.2.2, which removes the unchecked lookup and validates constructor names.

The CVSS score of 8.6 indicates a high‑severity vulnerability that can be exploited remotely. Because the attacker only needs to supply a malicious dashboard configuration, an attacker who can influence the dashboard data can trigger the flaw during normal rendering. The EPSS score is unavailable, but the lack of listed status in the CISA KEV catalog does not diminish the potential impact. The vulnerability is exploitable by injecting crafted configurations into any component that renders dashboards on a page, and does not require additional privileges or interaction, making it a serious threat for publicly exposed dashboards.