CVE-2026-118252 — Highcharts Dashboards sidebar component labels are parsed as HTML

Language strings in the Highcharts Dashboards edit-mode sidebar are parsed as HTML rather than inserted as text. An attacker who controls these language options can supply markup containing event handlers, which execute in the origin of the page hosting the dashboard when the sidebar renders the affected labels.