Highcharts Dashboards edit‑mode sidebar mistakenly interprets component language strings as HTML. When an attacker controls the language configuration they can inject markup that includes event handlers. Upon opening the edit‑mode sidebar, those handlers execute in the context of the hosting page, enabling the attacker to run arbitrary JavaScript. This creates a classic DOM‑based cross‑site scripting flaw that could deface the page, steal credentials or tokens, or perform other malicious actions in the user’s browser.

The vulnerability exists in Highcharts Dashboards and the core Highcharts library for all releases from 1.0.0 up to and including 4.2.2. The issue was fixed in Dashboards 4.2.3 and later releases.

The CVSS base score of 8.4 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The likely attack vector involves an attacker who can inject or modify the Dashboards language configuration; once the edit‑mode sidebar is rendered, the injected HTML runs in the page origin. Because the flaw is a DOM XSS, exploitation only requires a user to view the affected sidebar, making it relatively easy for a malicious configuration to impact users.