Highcharts Grid pagination module hit by DOM XSS flaw rated 8.6

A DOM-based XSS vulnerability, CVE-2026-118254, was found in the pagination module of Highcharts Grid (@highcharts/grid-lite and @highcharts/grid-pro), rated CVSS 8.6. The flaw stems from unsafe innerHTML assignment of lang.pageInfo and lang.pageSizeLabel; versions 2.0.0 through 3.1.x are affected and 3.2.0 fixes it.

• Affected: @highcharts/grid-lite and grid-pro 2.0.0 to 3.2.0
• Fix in 3.2.0 replaces innerHTML with textContent
• CVSS 8.6, public PoC exists, not in CISA KEV
• Highcharts Core below 13.0.0-beta.2 also affected