Live › vulnerability › CVE-2026-118248
Go to dashboardHighcharts Dashboards edit mode walks editableOptions property paths without rejecting __proto__ or constructor keys, so a crafted path lets a user's edit write a value onto Object.prototype. Every JavaScript object on the page then inherits that attacker-chosen property, and the real impact depends on how the host application uses it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Applications running Highcharts Dashboards from 1.0.0 through 4.2.2 where edit mode is enabled and editableOptions can contain attacker-influenced property paths. Sites that do not use Dashboards edit mode, or that only use fixed editableOptions written by the developer, are much less exposed. Teams on 4.2.2 or later can skip it.
No product ranges from the sources yet.
npm ls highcharts or by checking highcharts in package.json and the lockfile.4.2.2 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through proto or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.
This page as .md · .json · in your agent: get_signal("CVE-2026-118248")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.