Highcharts JS JavaScript Library Vulnerability Affecting Dashboards and Grid Pro

CVE-2026-118247

What is CVE-2026-118247?

The Highcharts JS library presents a vulnerability due to its handling of untrusted column IDs in the DataTable single-cell writers. Specifically, versions from 1.0.0 to 4.2.2 for Dashboards and from 2.0.0 to 3.2.0 for Grid Pro allow manipulation of the Object.prototype or Object constructor. This occurs when Integers are written into inherited properties, potentially leading to unintended side effects such as altered control flow or rendering issues across the application. Exploitation of this issue necessitates control of the relevant table or component column ID, making it crucial for users to upgrade to the patched versions 4.2.2 and 3.2.0 respectively.

References