GHSA-wg5j-9wp8-2ggm: Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype

Published Oct 28, 2026

Updated

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through proto or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Highcharts Dashboards to a version that resolves this vulnerability.
Fixed in 4.2.2

Event History

Oct 28, 2026

CVE Published

via OSV·05:55 PM

Data Sourced

via OSV·05:55 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Applications using Highcharts Dashboards versions from 1.0.0 through 4.2.1 are exposed if an attacker can control editableOptions and can cause a user to perform an edit. The impact depends on how other JavaScript running on the page consumes inherited object properties.

What does an attacker need to exploit it?

The attacker needs control over an editableOptions propertyPath that traverses __proto__ or constructor, plus user interaction with the configured edit. The vulnerable edit operation then writes the selected value to Object.prototype.

Are default deployments affected?

The provided information does not establish that default configurations are exploitable. Exploitation specifically requires attacker-controlled editableOptions and a user edit action.

What should be done if upgrading is not immediately possible?

Prevent untrusted parties from controlling editableOptions propertyPath values, and reject paths containing __proto__ or constructor before they reach Dashboards edit mode. Upgrading to 4.2.2 resolves the issue.

How can I determine whether an application may be affected?

Check whether it uses Highcharts Dashboards 1.0.0 through 4.2.1 and whether editableOptions or their propertyPath segments can be influenced by untrusted input. Review configured paths for prototype-related keys such as __proto__ and constructor.

GHSA-wg5j-9wp8-2ggm: Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Are default deployments affected?

What should be done if upgrading is not immediately possible?

How can I determine whether an application may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit it?

Are default deployments affected?

What should be done if upgrading is not immediately possible?

How can I determine whether an application may be affected?