---
id: "CVE-2026-118250"
kind: "vulnerability"
aliases: ["CVE-2026-118250", "GHSA-rmqc-xvr3-v46c"]
title: "Highcharts: dotted series.keys paths write to Object.prototype"
severity: "high"
cvss: 7.2
epss: null
exploited: false
status: "open"
category: "package"
products: [{"name": "highcharts", "fixed": ["12.6.1"], "affected": ">= 12.0.0, < 12.6.1", "ecosystem": "npm"}, {"name": "highcharts", "fixed": ["13.1.0"], "affected": ">= 13.0.0, <= 13.0.2", "ecosystem": "npm"}, {"name": "highcharts", "fixed": ["11.4.9"], "affected": ">= 6.1.0, < 11.4.9", "ecosystem": "npm"}]
ecosystems: ["npm"]
tags: ["cwe-1321", "frontend", "highcharts", "javascript", "package", "self-hosted"]
not_affected_if: ["static-config", "trusted-data-only"]
published_at: "2026-10-28T18:17:16+00:00"
first_seen_at: "2026-10-28T18:34:34+00:00"
updated_at: "2026-10-28T19:56:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118250", "first_seen_at": "2026-10-28T18:34:34+00:00"}, {"source": "ghsa", "url": "https://github.com/advisories/GHSA-rmqc-xvr3-v46c", "first_seen_at": "2026-10-28T19:56:29+00:00"}]
---

# Highcharts: dotted series.keys paths write to Object.prototype

Highcharts follows dot-separated series.keys paths without filtering __proto__ segments, so an attacker who controls chart series configuration and point data can write properties onto Object.prototype. Those properties then appear to all JavaScript running on the page.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- npm:highcharts affected >= 12.0.0, < 12.6.1 fixed 12.6.1
- npm:highcharts affected >= 13.0.0, <= 13.0.2 fixed 13.1.0
- npm:highcharts affected >= 6.1.0, < 11.4.9 fixed 11.4.9

## How to check

- Find the installed Highcharts version in `package.json` or the lockfile and compare it to the fixed releases.
- Search the codebase for `series.keys` to see whether chart configuration is built from user-controlled input.

## Fix

- Upgrade the `highcharts` package to `11.4.9`, `12.6.1`, or `3.1.0`, depending on the major line in use.
- Until upgraded, do not pass untrusted data into `series.keys` or point data.

## Timeline

- 2026-10-28T18:34:34+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118250
- 2026-10-28T19:56:29+00:00 ghsa https://github.com/advisories/GHSA-rmqc-xvr3-v46c

## From the sources

### Impact
A dot-separated key path taken from `series.keys` is followed without filtering the individual segments. An attacker who controls `series.keys` and the matching point data can use a path such as `__proto__.polluted` to set arbitrary properties on `Object.prototype`. The resulting properties are visible to all JavaScript running in the page, not only to the chart. No user interaction is required beyond rendering the chart.

The injected properties are inert until other code on the page reads them, so consequences depend on the consuming application.

### Workarounds
Drop-in fix - for any versions affected (6.1.0-13.0.2). Add the below IIFE to run after Highcharts is loaded.

```javascript
((H)=>{const X = H.isObject;H.Point.prototype.setNestedProperty = function setNestedProperty(t,e,i){let s=i.split(".");return s.some(t=>"__proto__"===t||"constructor"===t)||s.reduce(function(t,i,s,o){let r=o.length-1===s;return t[i]=r?e:X(t[i],!0)?t[i]:{},t[i]},t),t};})(Highcharts);
```

[Live demo & testing](https://jsfiddle.net/BlackLabel/z3rbtm7u/)

### Obtaining the patched version
The patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install highcharts@13.1.1`. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example `https://code.highcharts.com/13.1.1/highcharts.js`. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/getting-started/installation).

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_