Highcharts Grid XSS via credits.href rated 8.4

CVE-2026-118255 (CVSS 8.4) in Highcharts Grid and Grid Pro lets attackers run arbitrary JavaScript via a javascript: URI in credits.href. Fixes ship in @highcharts/grid-pro 3.2.0, @highcharts/dashboards 4.0.0 and highcharts 13.0.0-beta.2.

• XSS triggers when a user clicks a credits link with a javascript: URI
• Affected: grid-pro 2.0.0–3.1.x, dashboards 3.2.0–3.9.x, highcharts below 13.0.0-beta.2
• The patch routes href through AST.filterUserAttributes
• No public exploitation reported so far