Highcharts GP/Grid 2.0.0 through 3.2.0 fails to validate the URL scheme supplied to credits.href. When an attacker who controls the Grid configuration embeds a javascript: URL, clicking the resulting credits link triggers the browser to execute that script within the origin of the hosting page. This stored script injection flaw, classified as CWE-79, allows the attacker to run arbitrary code in the context of the web application, giving full access to application data, session state, and any other privileges available to the application.

The vulnerability affects the Highcharts Grid modules found in the @highcharts:dashboards, @highcharts:grid-pro, and highcharts:highcharts npm packages for versions 2.0.0 through 3.2.0. The issue is resolved in Grid Pro 3.2.0 and later releases, but earlier versions that embed the vulnerable Grid library remain susceptible.

The CVSS score of 8.4 indicates high severity. EPSS data is unavailable and the vulnerability is not yet listed in CISA’s KEV catalog. Exploitation requires the attacker to supply a malicious Grid configuration that is incorporated into a served page and the user to interact with the credits link. Although this user interaction limits widespread automatic exploitation, the potential impact of a successful attack is complete compromise of the host origin, enabling data theft, persistence, or lateral movement. The lack of an input sanitization measure means the flaw is a classic stored cross‑site scripting vulnerability with the same immediacy and impact as any other remote code execution flaw.