{"id":"CVE-2026-118249","aliases":["EUVD-2026-112363","GHSA-gfvx-2c2g-38wq"],"status":"published","title":"Highcharts: series column construction writes to Object.prototype","description":"Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.","severity":{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00363,"percentile":0.30536,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1321"],"published":"2026-10-28T17:57:18Z","modified":"2026-10-31T02:30:53Z","fixes":[{"ecosystem":"npm","package":"highcharts","fixed_in":["13.1.0"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"npm","package":"highcharts","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"13.0.0"},{"last_affected":"13.0.2"},{"fixed":"13.1.0"}]}]},{"source":"osv","ecosystem":"npm","package":"highcharts","ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"13.1.0"}]}]}],"products":[{"vendor":"highcharts","product":"highcharts"}],"references":[{"url":"https://github.com/highcharts/highcharts/security/advisories/GHSA-gfvx-2c2g-38wq","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/highcharts/highcharts/pull/25321","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/highcharts/highcharts/commit/d3357705c8f348904441327e32f50ab528c3a205","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/highcharts/highcharts/releases/tag/v13.1.0","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118249","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-gfvx-2c2g-38wq"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118249.json","tags":["advisory"]},{"url":"https://github.com/highcharts/highcharts","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-118249","title":"Highcharts: series column construction writes to Object.prototype","description":"Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.","status":"published","published":"2026-10-28T17:57:18.323Z","modified":"2026-10-29T20:55:21.954Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high","assessor":"cna"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:20:03.827373Z"}],"euvd":[{"id":"EUVD-2026-112363","description":"Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.","status":"published","published":"2026-10-28T17:57:18Z","modified":"2026-10-29T20:55:21Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high"}],"updated_at":"2026-11-02T16:59:14.591479Z"}],"ghsa":[{"id":"GHSA-gfvx-2c2g-38wq","title":"Highcharts: series column construction writes to Object.prototype","description":"### Impact\nWhen series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches `Object.prototype` and the `Object` constructor. Keys named `__proto__` and `constructor` survive `JSON.parse` as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on `Object.prototype`, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the attacker's value, and `for...in` over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. The properties remain in place once the chart has been built, and no user interaction is required beyond rendering the chart.\n\nConsequences beyond disruption depend on the consuming application.\n\n### Workarounds\nDrop-in fix - for any versions affected (6.1.0-13.0.2).\nAdd the below IIFE to run after Highcharts is loaded.\n\n```javascript\n;!function(t){if(t\u0026\u0026t.Point\u0026\u0026!t.Point.prototype.protoPollutionPatched){var o=t.Point.prototype,r=o.optionsToObject,e=o.setNestedProperty,n=Object.prototype.hasOwnProperty;o.optionsToObject=function(t){if(t\u0026\u0026\"object\"==typeof t\u0026\u0026!Array.isArray(t)\u0026\u0026(n.call(t,\"__proto__\")||n.call(t,\"constructor\"))){var o={};for(var e in t)n.call(t,e)\u0026\u0026!c(e)\u0026\u0026(o[e]=t[e]);t=o}return r.call(this,t)},o.setNestedProperty=function(t,o,r){return String(r).split(\".\").some(c)?t:e.call(this,t,o,r)},o.protoPollutionPatched=!0}function c(t){return\"__proto__\"===t||\"constructor\"===t}}(Highcharts);\n```\n\n[Live demo \u0026 testing](https://jsfiddle.net/BlackLabel/nopc6vhj/)\n\n### Obtaining the patched version\nThe patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install highcharts@13.1.0`. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example `https://code.highcharts.com/13.1.0/highcharts.js`. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/getting-started/installation).","status":"published","published":"2026-10-28T19:56:13Z","modified":"2026-10-28T19:56:15Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T14:41:39.926569Z"}],"nvd":[{"id":"CVE-2026-118249","description":"Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.","status":"published","published":"2026-10-28T18:17:16.273Z","modified":"2026-10-29T21:17:15.3Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-1321"],"updated_at":"2026-11-04T18:06:24.696141Z"}],"osv":[{"id":"CVE-2026-118249","title":"Highcharts: series column construction writes to Object.prototype","description":"Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.","status":"published","published":"2026-10-28T17:57:18.323Z","modified":"2026-10-31T02:30:53.081199384Z","cvss":[{"version":"4.0","score":7.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:44:57.008854Z"},{"id":"GHSA-gfvx-2c2g-38wq","title":"Highcharts: series column construction writes to Object.prototype","description":"### Impact\nWhen series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches `Object.prototype` and the `Object` constructor. Keys named `__proto__` and `constructor` survive `JSON.parse` as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on `Object.prototype`, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the attacker's value, and `for...in` over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. The properties remain in place once the chart has been built, and no user interaction is required beyond rendering the chart.\n\nConsequences beyond disruption depend on the consuming application.\n\n### Workarounds\nDrop-in fix - for any versions affected (6.1.0-13.0.2).\nAdd the below IIFE to run after Highcharts is loaded.\n\n```javascript\n;!function(t){if(t\u0026\u0026t.Point\u0026\u0026!t.Point.prototype.protoPollutionPatched){var o=t.Point.prototype,r=o.optionsToObject,e=o.setNestedProperty,n=Object.prototype.hasOwnProperty;o.optionsToObject=function(t){if(t\u0026\u0026\"object\"==typeof t\u0026\u0026!Array.isArray(t)\u0026\u0026(n.call(t,\"__proto__\")||n.call(t,\"constructor\"))){var o={};for(var e in t)n.call(t,e)\u0026\u0026!c(e)\u0026\u0026(o[e]=t[e]);t=o}return r.call(this,t)},o.setNestedProperty=function(t,o,r){return String(r).split(\".\").some(c)?t:e.call(this,t,o,r)},o.protoPollutionPatched=!0}function c(t){return\"__proto__\"===t||\"constructor\"===t}}(Highcharts);\n```\n\n[Live demo \u0026 testing](https://jsfiddle.net/BlackLabel/nopc6vhj/)\n\n### Obtaining the patched version\nThe patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install highcharts@13.1.0`. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example `https://code.highcharts.com/13.1.0/highcharts.js`. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/getting-started/installation).","status":"published","published":"2026-10-28T19:56:13Z","modified":"2026-10-28T20:15:06.101208831Z","cvss":[{"version":"4.0","score":7.1,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L","level":"high"}],"cwes":["CWE-1321"],"updated_at":"2026-11-02T15:46:47.822182Z"}]}}