{"id":"CVE-2026-118248","kind":"vulnerability","aliases":["CVE-2026-118248"],"related":[],"title":"Highcharts Dashboards: prototype pollution via edit mode lets an attacker alter page JavaScript","description":"Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.","summary":"Highcharts Dashboards edit mode walks editableOptions property paths without rejecting __proto__ or constructor keys, so a crafted path lets a user's edit write a value onto Object.prototype. Every JavaScript object on the page then inherits that attacker-chosen property, and the real impact depends on how the host application uses it.","severity":"medium","cvss":6.9,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["highcharts","javascript","package","web-frontend"],"not_affected_if":["default-config","static-editableoptions"],"how_to_check":"- Find the installed Highcharts version with `npm ls highcharts` or by checking `highcharts` in package.json and the lockfile.\n- Check whether the application uses Highcharts Dashboards edit mode and whether editableOptions can be influenced by untrusted data.","fix":"- Upgrade Highcharts to `4.2.2` or later.","status":"open","published_at":"2026-10-28T18:17:15+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","triaged_at":"2026-10-28T18:35:02+00:00","updated_at":"2026-10-28T18:35:02+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-10-28T18:35:02Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade Highcharts to `4.2.2` or later.","reach":"internet","title":"Highcharts Dashboards: prototype pollution via edit mode lets an attacker alter page JavaScript","impact":"medium","summary":"Highcharts Dashboards edit mode walks editableOptions property paths without rejecting __proto__ or constructor keys, so a crafted path lets a user's edit write a value onto Object.prototype. Every JavaScript object on the page then inherits that attacker-chosen property, and the real impact depends on how the host application uses it.","category":"package","nicknames":[],"who_cares":["javascript","highcharts","web-frontend"],"confidence":0.6,"needs_auth":"unknown","worst_case":"attacker alters JavaScript object behavior across the page","analyst_note":"Sources do not say whether an attacker needs to control editableOptions via stored data or only via a user's own edit; check the NVD entry and Highcharts 4.2.2 release notes for the exact trigger.","how_to_check":"- Find the installed Highcharts version with `npm ls highcharts` or by checking `highcharts` in package.json and the lockfile.\n- Check whether the application uses Highcharts Dashboards edit mode and whether editableOptions can be influenced by untrusted data.","needs_analyst":true,"not_affected_if":["default-config","static-editableOptions"],"who_is_affected":"Applications running Highcharts Dashboards from 1.0.0 through 4.2.2 where edit mode is enabled and editableOptions can contain attacker-influenced property paths. Sites that do not use Dashboards edit mode, or that only use fixed editableOptions written by the developer, are much less exposed. Teams on 4.2.2 or later can skip it.","user_interaction":"yes","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.00066,"input_tokens":3379,"output_tokens":644,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-118248':16A,19A '-2026':15A,18A '1.0.0':89C '4.2.2':91C,152C 'alter':11A 'applic':76B,146C 'attack':10A,64B,107C 'attacker-chosen':63B 'base':85C 'becom':133C 'chart':83C 'chosen':65B 'configur':126C 'consequ':141C 'constructor':38B,118C 'consum':145C 'control':109C 'craft':42B 'cve':14A,17A 'dashboard':2A,27B,93C 'depend':71B 'determin':142C 'edit':6A,28B,48B,94C,123C 'editableopt':31B,97C,110C 'everi':54B 'fix':150C 'frontend':25B 'highchart':1A,20B,26B,78C,92C 'host':75B 'impact':70B 'inherit':61B 'issu':148C 'javascript':13A,21B,55B,82C,136C 'js':79C 'key':39B,105C 'let':8A,44B 'librari':84C 'mode':7A,29B,95C 'object':56B 'object.prototype':53B,129C 'onto':52B,128C 'packag':22B 'page':12A,59B,139C 'path':33B,43B,114C 'pollut':4A 'properti':32B,66B,131C 'propertypath':98C 'proto':36B,116C 'prototyp':3A,103C 'prototype-rel':102C 'provid':112C 'real':69B 'reject':35B,101C 'relat':104C 'segment':99C 'svg':87C 'throughout':137C 'use':77B 'user':46B,121C 'valu':51B,127C 'via':5A 'visibl':134C 'walk':30B,96C 'web':24B 'web-frontend':23B 'without':34B,100C 'write':49B,124C","nicknames":[],"mitigations":[],"who_affected":"Applications running Highcharts Dashboards from 1.0.0 through 4.2.2 where edit mode is enabled and editableOptions can contain attacker-influenced property paths. Sites that do not use Dashboards edit mode, or that only use fixed editableOptions written by the developer, are much less exposed. Teams on 4.2.2 or later can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118248","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118248","severity":null,"published_at":"2026-10-28T18:17:15+00:00","modified_at":"2026-10-28T18:17:15+00:00","first_seen_at":"2026-10-28T18:34:33+00:00","fetched_at":"2026-10-28T18:34:33+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}