Highcharts Dashboards versions from 1.0.0 up to 4.2.3 incorrectly parse fullscreen mode labels as HTML when the library is in edit mode. This allows an attacker who can supply language options to embed markup containing event handlers that are executed in the hosting page’s origin. The result is client‑side code execution, which can compromise confidentiality, integrity, and availability of the compromised page, and gives the attacker the same privileges as the page’s scripts.

All deployments using the Highcharts Dashboards component or the core Highcharts library prior to version 4.2.3 that enable edit mode and include the viewFullscreen context‑menu item are affected. Products listed as @highcharts:dashboards and highcharts:highcharts are the specific components that contain the vulnerable parsing logic.

The CVSS score of 8.4 classifies this as high severity. No EPSS score is available, and the vulnerability is not listed in CISA KEV. The exposure requires that the attacker can modify the dashboard’s language settings, which is typically an internal or privileged capability. Therefore, the most likely attack vector is an internal attacker or compromise of an editor interface that controls language options. The lack of a publicly accessible exploitation path reduces the immediate threat to systems that do not expose these settings to untrusted users.