CVE-2026-118248: Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through proto or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Highcharts Dashboardsto a version that resolves this vulnerability.Fixed in 4.2.2
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Highcharts Dashboards versions from 1.0.0 through 4.2.1 are exposed if an attacker can control editableOptions and a user performs an edit that follows the supplied propertyPath.
What does an attacker need to exploit it?
The attacker must be able to supply editableOptions containing a propertyPath that traverses __proto__ or constructor. A user edit then writes the configured value to Object.prototype, making it available to JavaScript across the page.
Is there a fixed version?
Yes. Highcharts Dashboards 4.2.2 fixes the issue.