{"id":"CVE-2026-118247","kind":"vulnerability","aliases":["CVE-2026-118247","GHSA-c75x-9x9h-28rm"],"related":[],"title":"Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.","description":"### Impact\nWhen a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of `__proto__` resolves to `Object.prototype`, is taken for an existing column, and the write lands at the row index on `Object.prototype`; a column id of `constructor` writes onto the `Object` constructor in the same way. In Dashboards releases that still supported column aliases, the id is first resolved through the alias map, so a literal `__proto__` id is redirected harmlessly there, while an alias whose target is `__proto__`, which the connector's data table options accept, reaches the same write. An attacker who controls the column id can thereby set integer-keyed properties on `Object.prototype`, one per row index, holding the written value; named properties cannot be reached through these paths, because the row index is a number. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the injected value, and `for...in` over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. In Dashboards the write is reached through the Highcharts component's connector write-back, which is enabled by default through `allowConnectorUpdate` and takes the column id from the component's `columnAssignment`, or in the earliest releases from the series name, when a point is updated; in Grid Pro it is reached through cell editing in earlier releases and remains reachable through the public `DataTable` API. Exploitation requires that untrusted data reach the board or Grid configuration and that a point be updated or a cell edited, or that the application write a cell with an untrusted column id.\n\nConsequences beyond disruption depend on the consuming application.\n\n### Workarounds\nTwo measures are needed. The first closes the paths that reach `Object.prototype`; the second covers table construction, which cannot be patched from outside the library.\n\n#### 1. Strip unsafe keys from untrusted column data\n\nApply this wherever column data enters your application, before it is handed to a grid, board or `DataTable`. This is the only measure that covers the `DataTable` constructor.\n\n```js\nfunction stripUnsafeColumnIds(columns) {\n    for (const key of ['__proto__', 'constructor']) {\n        if (Object.prototype.hasOwnProperty.call(columns, key)) {\n            delete columns[key];\n        }\n    }\n\n    return columns;\n}\n\nGrid.grid('container', {\n    data: { columns: stripUnsafeColumnIds(untrustedColumns) }\n});\n```\n\n#### 2. Patch the DataTable methods\n\nNeeded if your application passes column ids that originate from untrusted input to `setCell`, `changeColumnId` or `setColumns`. Run it once at startup.\n\n```js\n{\n    const { DataTable } = Grid; // Or Dashboards\n\n    if (!DataTable) {\n        throw new Error('Patch loaded before Grid');\n    }\n\n    const unsafe = (id) => id === '__proto__' || id === 'constructor';\n\n    const setCell = DataTable.prototype.setCell;\n    DataTable.prototype.setCell = function (columnId, ...rest) {\n        if (unsafe(columnId)) {\n            return;\n        }\n        return setCell.call(this, columnId, ...rest);\n    };\n\n    const changeColumnId = DataTable.prototype.changeColumnId;\n    DataTable.prototype.changeColumnId = function (columnId, newColumnId) {\n        if (unsafe(columnId) || unsafe(newColumnId)) {\n            return false;\n        }\n        return changeColumnId.call(this, columnId, newColumnId);\n    };\n\n    const setColumns = DataTable.prototype.setColumns;\n    DataTable.prototype.setColumns = function (columns, ...rest) {\n        const safe = {};\n\n        for (const key of Object.keys(columns || {})) {\n            if (!unsafe(key)) {\n                safe[key] = columns[key];\n            }\n        }\n\n        return setColumns.call(this, safe, ...rest);\n    };\n}\n```\n\nFor npm, take `DataTable` from your import instead of the global — it is exported by Grid Lite, Grid Pro and Dashboards alike.\n\n### Obtaining the patched version\nThe patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install @highcharts/dashboards@4.2.2`. If you load Highcharts Dashboards from a CDN, use a versioned URL, for example `https://code.highcharts.com/dashboards/4.2.2/dashboards.js`. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/dashboards/installation).","summary":"Highcharts DataTable single-cell writers accept __proto__ or constructor as column IDs, so a write can put values onto Object.prototype or the Object constructor. Those inherited values then change array and object reads and for-in loops across the whole page, which can alter control flow or break rendering.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"@highcharts/dashboards","fixed":["4.2.2"],"affected":">= 1.0.0, <= 4.2.1","ecosystem":"npm"},{"name":"@highcharts/grid-pro","fixed":["3.2.0"],"affected":">= 2.0.0, <= 3.1.0","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-1321","dashboards","frontend","grid-pro","highcharts","javascript","package"],"not_affected_if":["auth-required","no-datatable-writes","static-charts"],"how_to_check":"- Check the installed Highcharts Dashboards version (`npm ls @highcharts/dashboards` or `unknown` if not from npm) and whether it is below `4.2.2`.\n- Check the installed Highcharts Grid Pro version (`npm ls @highcharts/grid-pro` or `unknown`) and whether it is below `3.2.0`.\n- Check whether connector write-back or Grid Pro cell editing lets users or data sources set column IDs.","fix":"- Upgrade Highcharts Dashboards to `4.2.2` or later.\n- Upgrade Highcharts Grid Pro to `3.2.0` or later.","status":"open","published_at":"2026-10-28T18:17:15+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:34:59+00:00","updated_at":"2026-10-28T19:56:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T18:34:59Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Highcharts Dashboards to `4.2.2` or later.\n- Upgrade Highcharts Grid Pro to `3.2.0` or later.","reach":"unknown","title":"Highcharts DataTable: column ID lets writes pollute JavaScript prototypes","impact":"medium","summary":"Highcharts DataTable single-cell writers accept __proto__ or constructor as column IDs, so a write can put values onto Object.prototype or the Object constructor. Those inherited values then change array and object reads and for-in loops across the whole page, which can alter control flow or break rendering.","category":"package","nicknames":[],"who_cares":["highcharts","javascript","frontend","dashboards","grid-pro"],"confidence":0.7,"needs_auth":"unknown","worst_case":"Inherited values alter page logic or break rendering","analyst_note":"","how_to_check":"- Check the installed Highcharts Dashboards version (`npm ls @highcharts/dashboards` or `unknown` if not from npm) and whether it is below `4.2.2`.\n- Check the installed Highcharts Grid Pro version (`npm ls @highcharts/grid-pro` or `unknown`) and whether it is below `3.2.0`.\n- Check whether connector write-back or Grid Pro cell editing lets users or data sources set column IDs.","needs_analyst":false,"not_affected_if":["static-charts","no-datatable-writes","auth-required"],"who_is_affected":"Pages that use Highcharts DataTable writes through Dashboards connector write-back or Grid Pro editing, and where a column ID can come from untrusted input. Applications that only render static charts with no DataTable writes are not in the described path. Teams on Dashboards 4.2.2 or Grid Pro 3.2.0 and later can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000688,"input_tokens":3551,"output_tokens":666,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118247':17A,25A '-1321':29B '-2026':16A,24A '1':432C '2':493C '28rm':22A '9x9h':21A 'accept':44B,196C 'across':77B 'affect':244C 'alia':171C,184C 'alias':163C 'allowconnectorupd':320C 'alter':83B 'api':364C 'appli':440C 'applic':389C,405C,447C,501C 'array':68B,259C 'attack':202C,288C 'attacker-suppli':287C 'back':313C 'beyond':399C 'board':372C,455C 'branch':282C 'break':87B 'c75x':20A 'cannot':227C,425C 'cell':42B,93C,352C,384C,392C 'chang':67B 'changecolumnid':512C,559C 'changecolumnid.call':573C 'close':413C 'code':279C 'collect':114C 'column':7A,14A,49B,102C,113C,119C,131C,143C,162C,206C,324C,396C,438C,443C,471C,480C,483C,486C,490C,503C,582C,591C,597C 'columnassign':330C 'columnid':547C,551C,556C,563C,567C,575C 'compon':308C,328C 'configur':375C 'connector':191C,310C 'consequ':398C 'const':473C,521C,535C,542C,558C,577C,584C,587C 'construct':423C 'constructor':47B,62B,146C,151C,467C,477C,541C 'consum':404C 'contain':488C 'control':84B,204C 'cover':421C,464C 'cve':15A,23A 'cwe':28B 'dashboard':2A,30B,157C,300C,525C 'data':99C,193C,290C,369C,439C,444C,489C 'datat':39B,363C,457C,466C,496C,522C,527C 'datatab':607C 'datatable.prototype.changecolumnid':560C,561C 'datatable.prototype.setcell':544C,545C 'datatable.prototype.setcolumns':579C,580C 'datatable.setcell':5A 'default':318C 'delet':482C 'depend':401C 'disrupt':400C 'earlier':355C 'earliest':334C 'edit':353C,385C 'effect':298C 'enabl':316C 'enter':445C 'error':530C 'everi':245C 'exist':13A,130C 'exploit':365C 'fail':294C 'fals':571C 'filter':116C 'first':167C,412C 'flow':85B 'for-in':73B 'frontend':31B 'function':469C,546C,562C,581C 'ghsa':19A 'ghsa-c75x-9x9h-28rm':18A 'grid':3A,33B,346C,374C,454C,523C,534C 'grid-pro':32B 'grid.grid':487C 'hand':451C 'harmless':180C 'highchart':1A,35B,38B,307C 'highcharts/dashboards':26A 'highcharts/grid-pro':27A 'hold':221C 'id':50B,103C,120C,144C,165C,177C,207C,325C,397C,504C,537C,538C,540C 'impact':89C 'index':139C,220C,236C,256C 'inherit':64B 'inject':265C,275C 'input':509C 'integ':212C,241C 'integer-key':211C 'javascript':36B 'js':468C,520C 'key':108C,213C,242C,276C,435C,474C,481C,484C,588C,594C,596C,598C 'land':135C 'librari':431C 'liter':175C 'load':532C 'loop':76B 'map':172C 'measur':408C,462C 'method':497C 'name':225C,339C 'need':410C,498C 'new':529C 'newcolumnid':564C,569C,576C 'npm':605C 'number':239C 'object':61B,70B,150C,246C,262C,272C 'object.keys':590C 'object.prototype':58B,125C,141C,216C,418C 'object.prototype.hasownproperty.call':479C 'one':217C 'onto':57B,148C 'option':195C 'origin':506C 'out-of-rang':252C 'outsid':429C 'packag':37B 'page':80B,249C 'pass':502C 'patch':427C,494C,531C 'path':232C,415C 'per':218C 'plain':261C 'point':342C,379C 'pro':4A,34B,347C 'properti':214C,226C 'proto':10A,45B,122C,176C,188C,476C,539C 'public':362C 'put':55B 'rang':255C 'reach':197C,229C,304C,350C,370C,417C 'reachabl':359C 'read':71B,250C 'redirect':179C 'releas':158C,335C,356C 'remain':358C 'render':88B,292C 'requir':366C 'resolv':123C,168C 'rest':548C,557C,583C,603C 'return':263C,485C,552C,553C,570C,572C,599C 'row':138C,219C,235C 'run':515C 'safe':585C,595C,602C 'second':420C 'seri':338C 'set':210C 'setcel':511C,543C 'setcell.call':554C 'setcolumn':514C,578C 'setcolumns.call':600C 'side':297C 'singl':41B,92C 'single-cel':40B 'startup':519C 'still':160C,243C 'strip':433C 'stripunsafecolumnid':470C,491C 'suppli':289C 'support':161C 'tabl':100C,111C,194C,422C 'take':281C,322C,606C 'taken':127C 'target':186C 'therebi':209C 'throw':528C 'treat':9A 'two':407C 'unrel':278C 'unsaf':434C,536C,550C,566C,568C,593C 'untrust':368C,395C,437C,508C 'untrustedcolumn':492C 'updat':344C,381C 'use':105C,286C 'valu':56B,65B,94C,224C,266C 'way':155C 'wherev':442C 'whole':79B 'whose':185C 'without':115C 'workaround':406C 'write':53B,134C,147C,200C,302C,312C,390C 'write-back':311C 'writer':8A,43B 'written':96C,223C 'yield':273C","nicknames":[],"mitigations":[],"who_affected":"Pages that use Highcharts DataTable writes through Dashboards connector write-back or Grid Pro editing, and where a column ID can come from untrusted input. Applications that only render static charts with no DataTable writes are not in the described path. Teams on Dashboards 4.2.2 or Grid Pro 3.2.0 and later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118247","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118247","severity":null,"published_at":"2026-10-28T18:17:15+00:00","modified_at":"2026-10-28T18:17:15+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null},{"source":"ghsa","external_id":"GHSA-c75x-9x9h-28rm","url":"https://github.com/advisories/GHSA-c75x-9x9h-28rm","severity":"medium","published_at":"2026-10-28T19:55:37+00:00","modified_at":"2026-10-28T19:55:37+00:00","first_seen_at":"2026-10-28T19:56:29+00:00","fetched_at":"2026-10-28T19:56:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}