JavaScript Charting Library Vulnerability Affecting Highcharts Dashboards
CVE-2026-118243

5.3MEDIUM

Key Information:

Vendor

Highcharts

Status
Highcharts
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118243?

Highcharts Dashboards versions 1.0.0 to 4.2.2 are affected by a vulnerability where the application improperly manages DataCursor listener and state maps, allowing a crafted proto table ID via dataPool connector configuration to resolve to Object.prototype. This flaw enables sync registration to create an enumerable property on every object, which can be influenced through the sync group option. The exploitation of this vulnerability requires an untrusted dashboard configuration and active component synchronization, with no user interaction necessary apart from loading the board. It can result in disruptive behavior, such as extreme synchronization issues. The vulnerability was addressed in version 4.2.2.

Affected Version(s)

highcharts >= 1.0.0, < 4.2.2

References

https://github.com/highcharts/highcharts/security/advisor...
x_refsource_CONFIRM
https://github.com/highcharts/highcharts/commit/ade5a41a7...
x_refsource_MISC
https://github.com/highcharts/highcharts/releases/tag/das...
x_refsource_MISC

CVSS V4

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.