CVE-2026-118249: Highcharts: series column construction writes to Object.prototype
Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable proto and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Highchartsto a version that resolves this vulnerability.Fixed in 13.1.0
Event History
Frequently Asked Questions
Which deployments are affected?
Highcharts JS versions from 13.0.0 up to, but not including, 13.1.0 are affected. The issue is fixed in 13.1.0.
What must an attacker control to exploit this issue?
The attacker needs point objects with own enumerable __proto__ or constructor keys that are parsed and used when Highcharts builds series data columns. Exploitation occurs when the affected chart is rendered; no additional user interaction is required.
What is the likely impact after exploitation?
Integer-indexed writes can be directed to Object.prototype or the Object constructor. The resulting inherited values can affect property reads and for-in enumeration across the page, disrupting rendering or changing behavior in application code that consumes those objects.