Highcharts Grid versions 2.0.0 through 3.2.0 render pagination language strings directly into the DOM as markup instead of plain text. When the Grid language configuration is controlled by an attacker, they can insert arbitrary HTML elements with event handlers. These handlers execute in the hosting page’s origin when the pagination controls are rendered, effectively allowing the attacker to run arbitrary JavaScript in the user’s browser. This constitutes a classic cross‑site scripting (XSS) flaw that can lead to remote code execution within the context of the page.

Highcharts product families @highcharts:grid-lite, @highcharts:grid-pro, and highcharts:highcharts are impacted. Any installation using Grid libraries between versions 2.0.0 up to and including 3.2.0 is vulnerable. The vulnerability is fixed in release 3.2.0 and later.

The CVSS score of 8.6 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that pagination is enabled—a feature commonly used in dashboards. No additional user interaction is required beyond loading the page, so the attack vector is likely indirect, such as a malicious language configuration embedded in a source that feeds into the Grid component. Once triggered, the injected script runs with the privileges of the hosting page, potentially compromising confidential data or allowing further malicious actions.