{"id":"CVE-2026-118250","kind":"vulnerability","aliases":["CVE-2026-118250","GHSA-rmqc-xvr3-v46c"],"related":[],"title":"Highcharts: dotted series.keys paths write to Object.prototype","description":"### Impact\nA dot-separated key path taken from `series.keys` is followed without filtering the individual segments. An attacker who controls `series.keys` and the matching point data can use a path such as `__proto__.polluted` to set arbitrary properties on `Object.prototype`. The resulting properties are visible to all JavaScript running in the page, not only to the chart. No user interaction is required beyond rendering the chart.\n\nThe injected properties are inert until other code on the page reads them, so consequences depend on the consuming application.\n\n### Workarounds\nDrop-in fix - for any versions affected (6.1.0-13.0.2). Add the below IIFE to run after Highcharts is loaded.\n\n```javascript\n((H)=>{const X = H.isObject;H.Point.prototype.setNestedProperty = function setNestedProperty(t,e,i){let s=i.split(\".\");return s.some(t=>\"__proto__\"===t||\"constructor\"===t)||s.reduce(function(t,i,s,o){let r=o.length-1===s;return t[i]=r?e:X(t[i],!0)?t[i]:{},t[i]},t),t};})(Highcharts);\n```\n\n[Live demo & testing](https://jsfiddle.net/BlackLabel/z3rbtm7u/)\n\n### Obtaining the patched version\nThe patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install highcharts@13.1.1`. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example `https://code.highcharts.com/13.1.1/highcharts.js`. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/getting-started/installation).","summary":"Highcharts follows dot-separated series.keys paths without filtering __proto__ segments, so an attacker who controls chart series configuration and point data can write properties onto Object.prototype. Those properties then appear to all JavaScript running on the page.","severity":"high","cvss":7.2,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"highcharts","fixed":["12.6.1"],"affected":">= 12.0.0, < 12.6.1","ecosystem":"npm"},{"name":"highcharts","fixed":["13.1.0"],"affected":">= 13.0.0, <= 13.0.2","ecosystem":"npm"},{"name":"highcharts","fixed":["11.4.9"],"affected":">= 6.1.0, < 11.4.9","ecosystem":"npm"}],"ecosystems":["npm"],"tags":["cwe-1321","frontend","highcharts","javascript","package","self-hosted"],"not_affected_if":["static-config","trusted-data-only"],"how_to_check":"- Find the installed Highcharts version in `package.json` or the lockfile and compare it to the fixed releases.\n- Search the codebase for `series.keys` to see whether chart configuration is built from user-controlled input.","fix":"- Upgrade the `highcharts` package to `11.4.9`, `12.6.1`, or `3.1.0`, depending on the major line in use.\n- Until upgraded, do not pass untrusted data into `series.keys` or point data.","status":"open","published_at":"2026-10-28T18:17:16+00:00","first_seen_at":"2026-10-28T18:34:34+00:00","triaged_at":"2026-10-28T18:34:51+00:00","updated_at":"2026-10-28T19:56:29+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-10-28T18:34:51Z","model":"claude-haiku-5-5","output":{"fix":"- Upgrade the `highcharts` package to `11.4.9`, `12.6.1`, or `3.1.0`, depending on the major line in use.\n- Until upgraded, do not pass untrusted data into `series.keys` or point data.","reach":"internet","title":"Highcharts: prototype pollution via series.keys lets attacker set global properties","impact":"medium","summary":"Highcharts follows dot-separated series.keys paths without filtering __proto__ segments, so an attacker who controls chart series configuration and point data can write properties onto Object.prototype. Those properties then appear to all JavaScript running on the page.","category":"package","nicknames":[],"who_cares":["javascript","frontend","highcharts","self-hosted"],"confidence":0.7,"needs_auth":"unknown","worst_case":"attacker alters global JavaScript object behavior across the page","analyst_note":"Check the NVD and vendor advisory to confirm the exact affected ranges and whether any published exploit or real-world impact exists.","how_to_check":"- Find the installed Highcharts version in `package.json` or the lockfile and compare it to the fixed releases.\n- Search the codebase for `series.keys` to see whether chart configuration is built from user-controlled input.","needs_analyst":true,"not_affected_if":["static-config","trusted-data-only"],"who_is_affected":"Pages that render Highcharts charts where the series keys or point data come from users or other untrusted sources are exposed. Charts built only from fixed, server-controlled configuration with trusted data are unlikely to be affected.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000626,"input_tokens":3392,"output_tokens":573,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-1':207C '-118250':10A,18A '-1321':23B '-2026':9A,17A '/13.1.1/highcharts.js':281C '/blacklabel/z3rbtm7u/)':230C '/docs/getting-started/installation).':294C '0':217C '13.0.2':166C '13.1.1':263C '6.1.0':165C 'add':167C 'affect':164C,250C 'appear':61B 'applic':155C 'arbitrari':106C 'attack':44B,87C 'avail':239C 'beyond':132C 'cdn':270C 'channel':245C 'chart':47B,126C,135C 'code':143C 'code.highcharts.com':276C,280C 'code.highcharts.com/13.1.1/highcharts.js':279C 'configur':49B 'consequ':150C 'const':179C 'constructor':196C 'consum':154C 'control':46B,89C 'cve':8A,16A 'cwe':22B 'data':52B,95C 'demo':226C 'depend':151C 'distribut':244C 'dot':2A,34B,72C 'dot-separ':33B,71C 'drop':158C 'drop-in':157C 'e':186C,213C 'exampl':259C,278C 'filter':39B,82C 'fix':160C 'follow':32B,80C 'frontend':24B 'function':183C,199C 'ghsa':12A 'ghsa-rmqc-xvr3-v46c':11A 'guid':291C 'h':178C 'h.isobject':181C 'h.point.prototype.setnestedproperty':182C 'highchart':1A,25B,31B,174C,224C,262C,267C 'highcharts':19A,20A,21A 'host':30B 'i.split':190C 'iif':170C 'impact':69C 'individu':84C 'inert':140C 'inject':137C 'instal':261C,286C,290C 'interact':129C 'javascript':26B,64B,117C,177C 'jsfiddle.net':229C 'jsfiddle.net/blacklabel/z3rbtm7u/)':228C 'key':74C 'let':188C,204C 'list':256C 'live':225C 'load':176C,266C 'match':93C 'method':287C 'npm':247C,260C 'o':203C 'o.length':206C 'object.prototype':7A,57B,109C 'obtain':231C 'onto':56B 'packag':27B,251C 'page':68B,121C,146C 'patch':233C,236C,254C 'path':4A,37B,75C,99C 'point':51B,94C 'pollut':103C 'properti':55B,59B,107C,112C,138C 'proto':40B,102C,194C 'r':205C,212C 'read':147C 'releas':237C 'render':133C 'requir':131C 'result':111C 'return':191C,209C 'rmqc':13A 'run':65B,118C,172C 's.reduce':198C 's.some':192C 'see':288C 'segment':41B,85C 'self':29B 'self-host':28B 'separ':35B,73C 'seri':48B 'series.keys':3A,36B,78C,90C 'set':105C 'setnestedproperti':184C 'taken':76C 'test':227C 'upgrad':248C 'url':274C 'use':97C,271C 'user':128C 'usual':243C 'v46c':15A 'version':163C,234C,255C,273C 'visibl':114C 'without':38B,81C 'workaround':156C 'write':5A,54B 'www.highcharts.com':293C 'www.highcharts.com/docs/getting-started/installation).':292C 'x':180C,214C 'xvr3':14A","nicknames":[],"mitigations":[],"who_affected":"Pages that render Highcharts charts where the series keys or point data come from users or other untrusted sources are exposed. Charts built only from fixed, server-controlled configuration with trusted data are unlikely to be affected.","tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-28T18:17:16+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security-advisories@github.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118250","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118250","severity":null,"published_at":"2026-10-28T18:17:16+00:00","modified_at":"2026-10-28T18:17:16+00:00","first_seen_at":"2026-10-28T18:34:34+00:00","fetched_at":"2026-10-28T18:34:34+00:00","note":null},{"source":"ghsa","external_id":"GHSA-rmqc-xvr3-v46c","url":"https://github.com/advisories/GHSA-rmqc-xvr3-v46c","severity":"high","published_at":"2026-10-28T19:56:18+00:00","modified_at":"2026-10-28T19:56:20+00:00","first_seen_at":"2026-10-28T19:56:29+00:00","fetched_at":"2026-10-28T19:56:29+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}