{"id":"CVE-2026-116797","kind":"vulnerability","aliases":["CVE-2026-116797","GHSA-5ghw-9mgr-jvx2"],"related":[],"title":"Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`","description":"### Impact\nThe input-type cell renderers copy every entry of the renderer's `attributes` option onto the input or select element they create, without checking the attribute names. An attacker who controls the Grid configuration can supply entries under a column's `cells.renderer.attributes` or `cells.editMode.renderer.attributes` whose names are event handlers, and those handlers execute in the origin of the page hosting the Grid. A view renderer places the handler on the input rendered in every row of the column as soon as the Grid renders; an edit-mode renderer places it on the input created when a cell enters edit mode, and that input is focused immediately, so a `focus` handler runs as soon as the user starts editing. Exploitation requires that untrusted data reach the Grid configuration and that a user hover over or focus one of the rendered inputs, or begin editing a cell. The Pro DataGrid that shipped inside the Dashboards package is included.\n\n### Workarounds\n\nIf your column configuration comes from a source you do not fully control, paste this snippet right after importing the `Grid` module:\n\n```ts\nconst ALLOWED_RENDERER_ATTRIBUTES = [\n    'autofocus', 'checked', 'max', 'maxlength', 'min', 'minlength',\n    'multiple', 'pattern', 'placeholder', 'size', 'step'\n];\n\nconst scrubColumn = (column) => {\n    const cells = column?.cells;\n\n    for (const renderer of [cells?.renderer, cells?.editMode?.renderer]) {\n        const attributes = renderer?.attributes;\n\n        if (attributes) {\n            for (const key of Object.keys(attributes)) {\n                if (!ALLOWED_RENDERER_ATTRIBUTES.includes(key.toLowerCase())) {\n                    delete attributes[key];\n                }\n            }\n        }\n    }\n\n    return column;\n};\n\nconst scrubOptions = (options) => {\n    scrubColumn(options?.columnDefaults);\n    (options?.columns || []).forEach(scrubColumn);\n    return options;\n};\n\nconst proto = Grid.Grid.prototype;\n\nconst loadUserOptions = proto.loadUserOptions;\nproto.loadUserOptions = function (options, ...rest) {\n    scrubOptions(Grid.defaultOptions);\n    return loadUserOptions.call(this, scrubOptions(options), ...rest);\n};\n\nconst updateColumn = proto.updateColumn;\nproto.updateColumn = function (columnId, options, ...rest) {\n    return updateColumn.call(this, columnId, scrubColumn(options), ...rest);\n};\n```\n\n### Obtaining the patched version\nThe patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install @highcharts/grid-lite@3.2.0`. If you load Highcharts Grid from a CDN, use a versioned URL, for example `https://cdn.jsdelivr.net/npm/@highcharts/grid-lite@3.2.0/grid-lite.js`. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/grid/installation).","summary":"Highcharts Grid Pro copies cell renderer attributes straight onto input and select elements without sanitising them. An attacker who can control column configuration can add event-handler attributes that run script in the hosting page when a user hovers over, focuses or edits a cell.","severity":"high","cvss":8.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@highcharts/grid-pro","fixed":["3.2.0"],"affected":">= 2.0.0, <= 3.1.0","ecosystem":"npm"},{"name":"@highcharts/dashboards","fixed":["4.0.0"],"affected":"= 3.6.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-79","frontend","highcharts","javascript","package","web-apps"],"not_affected_if":["fixed-column-config","grid-pro-not-used"],"how_to_check":"- Check the installed Grid Pro version in `package.json` or the bundled file header; versions from `2.0.0` up to but not including `3.2.0` are affected.\n- Search the codebase for `cells.renderer.attributes` and `cells.editMode.renderer.attributes` to see whether column config is built from user-controlled data.","fix":"- Upgrade Highcharts Grid Pro to `3.2.0` or later.\n- Until upgraded, do not build column configuration from untrusted input.","status":"open","published_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:34:46+00:00","updated_at":"2026-10-28T19:56:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T18:34:46Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Highcharts Grid Pro to `3.2.0` or later.\n- Until upgraded, do not build column configuration from untrusted input.","reach":"internet","title":"Highcharts Grid Pro: column config attributes let scripts run in page","impact":"high","summary":"Highcharts Grid Pro copies cell renderer attributes straight onto input and select elements without sanitising them. An attacker who can control column configuration can add event-handler attributes that run script in the hosting page when a user hovers over, focuses or edits a cell.","category":"package","nicknames":[],"who_cares":["javascript","highcharts","frontend","web-apps"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Script runs in the hosting page origin, reading session data","analyst_note":"Confirm whether an attacker needs to control column config or whether stored or reflected user data can reach it; check the Highcharts advisory for the exact exploit conditions.","how_to_check":"- Check the installed Grid Pro version in `package.json` or the bundled file header; versions from `2.0.0` up to but not including `3.2.0` are affected.\n- Search the codebase for `cells.renderer.attributes` and `cells.editMode.renderer.attributes` to see whether column config is built from user-controlled data.","needs_analyst":true,"not_affected_if":["fixed-column-config","grid-pro-not-used"],"who_is_affected":"Applications that use Highcharts Grid Pro between 2.0.0 and 3.2.0 and let someone other than the developer influence column definitions or renderer attributes are exposed. Pages that only use fixed, developer-written column configs with no user input in that path are much less exposed. Teams not using Grid Pro can skip this.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000659,"input_tokens":3397,"output_tokens":638,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-116797':15A,23A '-2026':14A,22A '-79':27B '/docs/grid/installation).':422C '/npm/@highcharts/grid-lite@3.2.0/grid-lite.js':409C '3.2.0':392C '5ghw':18A '9mgr':19A 'add':59B 'affect':379C 'allow':265C 'allowed_renderer_attributes.includes':308C 'app':34B 'attack':52B,111C 'attribut':7A,41B,63B,95C,108C,267C,296C,298C,300C,306C,311C 'autofocus':268C 'avail':368C 'begin':225C 'cdn':400C 'cdn.jsdelivr.net':408C 'cdn.jsdelivr.net/npm/@highcharts/grid-lite@3.2.0/grid-lite.js':407C 'cell':5A,39B,80B,86C,180C,228C,283C,285C,290C,292C 'cell-render':4A 'cells.editmode.renderer.attributes':126C 'cells.renderer.attributes':124C 'channel':374C 'check':106C,269C 'column':56B,122C,160C,243C,281C,284C,314C,322C 'columndefault':320C 'columnid':350C,356C 'come':245C 'configur':57B,116C,210C,244C 'const':264C,279C,282C,287C,295C,302C,315C,327C,330C,345C 'control':55B,113C,253C 'copi':38B,88C 'creat':104C,177C 'cve':13A,21A 'cwe':26B 'dashboard':236C 'data':206C 'datagrid':231C 'delet':310C 'distribut':373C 'edit':78B,169C,182C,201C,226C 'edit-mod':168C 'editmod':293C 'element':47B,102C 'enter':181C 'entri':90C,119C 'event':61B,130C 'event-handl':60B 'everi':89C,156C 'exampl':388C,406C 'execut':135C 'exploit':202C 'focus':76B,188C,192C,218C 'foreach':323C 'frontend':28B 'fulli':252C 'function':334C,349C 'ghsa':17A 'ghsa-5ghw-9mgr-jvx2':16A 'grid':2A,36B,115C,144C,165C,209C,261C,397C 'grid.defaultoptions':338C 'grid.grid.prototype':329C 'guid':419C 'handler':62B,131C,134C,150C,193C 'highchart':1A,29B,35B,396C 'highcharts/dashboards':25A 'highcharts/grid-lite':391C 'highcharts/grid-pro':24A 'host':69B,142C 'hover':74B,215C 'immedi':189C 'impact':81C 'import':259C 'includ':239C 'input':44B,84C,99C,153C,176C,186C,223C 'input-typ':83C 'insid':234C 'instal':390C,414C,418C 'javascript':30B 'jvx2':20A 'key':303C,312C 'key.tolowercase':309C 'list':385C 'load':395C 'loaduseropt':331C 'loaduseroptions.call':340C 'map':8A 'max':270C 'maxlength':271C 'method':415C 'min':272C 'minlength':273C 'mode':170C,183C 'modul':262C 'multipl':274C 'name':109C,128C 'npm':376C,389C 'object.keys':305C 'obtain':360C 'one':219C 'onto':43B,97C 'option':96C,317C,319C,321C,326C,335C,343C,351C,358C 'origin':138C 'packag':31B,237C,380C 'page':70B,141C 'past':254C 'patch':362C,365C,383C 'pattern':275C 'place':148C,172C 'placehold':276C 'pro':3A,37B,230C 'proto':328C 'proto.loaduseroptions':332C,333C 'proto.updatecolumn':347C,348C 'raw':11A 'reach':207C 'releas':366C 'render':6A,40B,87C,93C,147C,154C,166C,171C,222C,266C,288C,291C,294C,297C 'requir':203C 'rest':336C,344C,352C,359C 'return':313C,325C,339C,353C 'right':257C 'row':157C 'run':65B,194C 'sanitis':49B 'script':66B 'scrubcolumn':280C,318C,324C,357C 'scrubopt':316C,337C,342C 'see':416C 'select':46B,101C 'setattribut':12A 'ship':233C 'size':277C 'snippet':256C 'soon':162C,196C 'sourc':248C 'start':200C 'step':278C 'straight':42B 'suppli':118C 'ts':263C 'type':85C 'untrust':205C 'updatecolumn':346C 'updatecolumn.call':354C 'upgrad':377C 'url':404C 'use':401C 'user':73B,199C,214C 'usual':372C 'version':363C,384C,403C 'view':146C 'web':33B 'web-app':32B 'whose':127C 'without':48B,105C 'workaround':240C 'written':9A 'www.highcharts.com':421C 'www.highcharts.com/docs/grid/installation).':420C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Highcharts Grid Pro between 2.0.0 and 3.2.0 and let someone other than the developer influence column definitions or renderer attributes are exposed. Pages that only use fixed, developer-written column configs with no user input in that path are much less exposed. Teams not using Grid Pro can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:14+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-116797","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-116797","severity":null,"published_at":"2026-10-28T18:17:14+00:00","modified_at":"2026-10-28T18:17:14+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null},{"source":"ghsa","external_id":"GHSA-5ghw-9mgr-jvx2","url":"https://github.com/advisories/GHSA-5ghw-9mgr-jvx2","severity":"high","published_at":"2026-10-28T19:56:02+00:00","modified_at":"2026-10-28T19:56:05+00:00","first_seen_at":"2026-10-28T19:56:29+00:00","fetched_at":"2026-10-28T19:56:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}