Highcharts Grid: pagination language options are parsed as HTML

Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace

Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>`

Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`

Highcharts Grid: javascript: URL in credits.href runs script on click

Highcharts Dashboards: fullscreen labels are parsed as HTML

Highcharts Dashboards: sidebar component labels are parsed as HTML

Highcharts: javascript: URL in credits.href runs script on click

Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes

In js/parts/SvgRenderer.js in Highcharts JS before 6.1.0, the use of backtracking regular expressions permitted an attacker to conduct a denial of service attack against the…

Highcharts: dotted series.keys paths write to Object.prototype

Highcharts: series column construction writes to Object.prototype

Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during print

Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts

Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

Highcharts JS is a JavaScript charting library based on SVG

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`