{"id":"CVE-2026-118248","published":"2026-10-28T18:17:15.870","lastModified":"2026-10-28T18:17:15.870","description":"Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-1321"],"vendors":[],"products":[],"references":[{"url":"https://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b","tags":[]},{"url":"https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2","tags":[]},{"url":"https://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm","tags":[]}],"exploitRefs":[{"url":"https://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b","tags":[]},{"url":"https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2","tags":[]},{"url":"https://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm","tags":[]}],"hasPoc":true,"ai":null}