---
id: "CVE-2026-118248"
kind: "vulnerability"
aliases: ["CVE-2026-118248"]
title: "Highcharts Dashboards: prototype pollution via edit mode lets an attacker alter page JavaScript"
severity: "medium"
cvss: 6.9
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["highcharts", "javascript", "package", "web-frontend"]
not_affected_if: ["default-config", "static-editableoptions"]
published_at: "2026-10-28T18:17:15+00:00"
first_seen_at: "2026-10-28T18:34:33+00:00"
updated_at: "2026-10-28T18:35:02+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118248", "first_seen_at": "2026-10-28T18:34:33+00:00"}]
---

# Highcharts Dashboards: prototype pollution via edit mode lets an attacker alter page JavaScript

Highcharts Dashboards edit mode walks editableOptions property paths without rejecting __proto__ or constructor keys, so a crafted path lets a user's edit write a value onto Object.prototype. Every JavaScript object on the page then inherits that attacker-chosen property, and the real impact depends on how the host application uses it.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the installed Highcharts version with `npm ls highcharts` or by checking `highcharts` in package.json and the lockfile.
- Check whether the application uses Highcharts Dashboards edit mode and whether editableOptions can be influenced by untrusted data.

## Fix

- Upgrade Highcharts to `4.2.2` or later.

## Timeline

- 2026-10-28T18:34:33+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118248

## From the sources

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_