JavaScript Charting Library Vulnerability in Highcharts by Highsoft
CVE-2026-118249

7.2HIGH

Key Information:

Vendor

Highcharts

Status
Highcharts
Vendor
CVE Published:
28 October 2026

What is CVE-2026-118249?

A vulnerability in Highcharts JS versions 13.0.0 to 13.1.0 allows for prototype pollution through the use of point option keys as column IDs in series data columns. This flaw enables addition of own enumerable proto and constructor keys from parsed point objects, allowing unauthorized integer-indexed writes to Object.prototype or the Object constructor. Such behavior can disrupt the rendering of charts, impacting the functioning of applications that use this library, without requiring user interaction beyond the rendering process. This issue has been addressed in version 13.1.0.

Affected Version(s)

highcharts >= 13.0.0, < 13.1.0

References

https://github.com/highcharts/highcharts/security/advisor...
x_refsource_CONFIRM
https://github.com/highcharts/highcharts/pull/25321
x_refsource_MISC
https://github.com/highcharts/highcharts/commit/d3357705c...
x_refsource_MISC

CVSS V4

Score:
7.2
Severity:
HIGH
Confidentiality:
Low
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.