JavaScript Charting Library Vulnerability in Highcharts by Highsoft
CVE-2026-118248

6.9MEDIUM

Key Information:

Vendor

Highcharts

Status
Highcharts
Dashboards
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118248?

A vulnerability exists in Highcharts JS, a popular JavaScript charting library, whereby the editableOptions propertyPath segments can be manipulated without proper validation. This allows an attacker who has control over editableOptions to utilize prototype-related keys, potentially leading to the overwriting of values on Object.prototype. As a result, these modifications become accessible globally within the JavaScript context throughout the page. The issue has been resolved in version 4.2.2, highlighting the importance of upgrading to secure versions.

Affected Version(s)

dashboards >= 1.0.0, < 4.2.2

highcharts < 13.1.0

References

https://github.com/highcharts/highcharts/security/advisor...
x_refsource_CONFIRM
https://github.com/highcharts/highcharts/commit/05efb9849...
x_refsource_MISC
https://github.com/highcharts/highcharts/releases/tag/das...
x_refsource_MISC

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
Unknown

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.