Live › vulnerability › CVE-2026-118250
Go to dashboardHighcharts follows dot-separated series.keys paths without filtering __proto__ segments, so an attacker who controls chart series configuration and point data can write properties onto Object.prototype. Those properties then appear to all JavaScript running on the page.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-28 18:34 UTC. All times on this page are UTC.
Pages that render Highcharts charts where the series keys or point data come from users or other untrusted sources are exposed. Charts built only from fixed, server-controlled configuration with trusted data are unlikely to be affected.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| highcharts | npm | >= 12.0.0, < 12.6.1 | 12.6.1 |
| highcharts | npm | >= 13.0.0, <= 13.0.2 | 13.1.0 |
| highcharts | npm | >= 6.1.0, < 11.4.9 | 11.4.9 |
package.json or the lockfile and compare it to the fixed releases.series.keys to see whether chart configuration is built from user-controlled input.highcharts package to 11.4.9, 12.6.1, or 3.1.0, depending on the major line in use.series.keys or point data.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
A dot-separated key path taken from series.keys is followed without filtering the individual segments. An attacker who controls series.keys and the matching point data can use a path such as __proto__.polluted to set arbitrary properties on Object.prototype. The resulting properties are visible to all JavaScript running in the page, not only to the chart. No user interaction is required beyond rendering the chart.
The injected properties are inert until other code on the page reads them, so consequences depend on the consuming application.
Drop-in fix - for any versions affected (6.1.0-13.0.2). Add the below IIFE to run after Highcharts is loaded.
((H)=>{const X = H.isObject;H.Point.prototype.setNestedProperty = function setNestedProperty(t,e,i){let s=i.split(".");return s.some(t=>"__proto__"===t||"constructor"===t)||s.reduce(function(t,i,s,o){let r=o.length-1===s;return t[i]=r?e:X(t[i],!0)?t[i]:{},t[i]},t),t};})(Highcharts);
The patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example npm install [email protected]. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example https://code.highcharts.com/13.1.1/highcharts.js. For more on each installation method, see the installation guide.
This page as .md · .json · in your agent: get_signal("CVE-2026-118250")
NVD data is provided by NIST and is public domain · GitHub Advisory Database, CC-BY 4.0. Posts quoted belong to their authors.