Uncontrolled Property Lookup Vulnerability in Highcharts Dashboards by Highcharts

CVE-2026-118245

What is CVE-2026-118245?

Highcharts Dashboards, a JavaScript library for visualizing data, contains a flaw that allows an attacker to manipulate the choice of a chart constructor via uncontrolled property lookup. When an attacker gains the ability to modify dashboard configurations, they can substitute a legitimate chart constructor with a potentially harmful utility function. This may lead to the execution of malicious code within the hosting page, as attacker-controlled options are passed along as properties or attributes. The vulnerability affects versions from 1.0.0 to 4.2.2 and can be exploited without any user interaction beyond rendering the board, which poses significant security risks for web applications utilizing this component.

References