JavaScript Charting Library Vulnerability in Highcharts by Highsoft
CVE-2026-118250
7.2HIGH
What is CVE-2026-118250?
The vulnerability in Highcharts JS arises from the handling of dot-separated series.keys paths without adequate filtering from versions 6.1.0 to 11.4.9, 12.6.1, and 3.1.0. An attacker can exploit this flaw if they control series.keys and the corresponding point data, leveraging a proto path to assign arbitrary properties to Object.prototype. This alteration makes the properties accessible across all JavaScript within the page, presenting a significant risk to the integrity of web applications using Highcharts JS. The issue has been resolved in recent updates.
Affected Version(s)
highcharts >= 6.1.0, < 11.4.9 < 6.1.0, 11.4.9
highcharts >= 12.0.0, < 12.6.1 < 12.0.0, 12.6.1
highcharts >= 13.0.0, < 13.1.0 < 13.0.0, 13.1.0