CVE-2026-118243 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates an enumerable property there whose suffix can be influenced through the sync group option. The property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and an enabled component sync, but no user interaction beyond loading the board. This issue is fixed in 4.2.2.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JS versions ranging from 1.0.0 to 4.2.2 constitutes a prototype pollution attack facilitated through improper handling of object properties during dashboard configuration synchronization. The core technical flaw resides in the DataCursor component, which maintains listener and state maps using plain JavaScript objects keyed by DataTable identifiers. When an attacker supplies a specially crafted table ID that resolves to _proto_ via the dataPool connector configuration, they effectively target Object.prototype rather than creating a new property on a specific instance. This behavior is exacerbated by the sync registration process, which creates enumerable properties on this prototype object. The suffix of these injected properties can be influenced through the sync group option, allowing for precise manipulation of the global JavaScript environment state.
From an operational impact perspective, this vulnerability allows for remote code execution or denial of service without requiring any user interaction beyond loading a maliciously configured dashboard page. Because the pollution occurs at the prototype level, the altered properties become visible on every object in the application context that inherits from Object.prototype. This widespread contamination can lead to unpredictable behavior across various features within the Highcharts ecosystem. Specifically, lasting sync states resulting from this injection can throw exceptions and disrupt critical functionalities such as extremes synchronization, effectively breaking chart rendering or data visualization capabilities for all users accessing the affected dashboard.
The exploitation vector relies on an untrusted dashboard configuration being processed by a system with component sync enabled. This highlights a significant risk in environments where dynamic configurations are loaded without sufficient validation of their structural integrity against prototype pollution patterns. The absence of user interaction requirements makes this vulnerability particularly dangerous, as it can be triggered automatically upon page load, affecting any visitor to the compromised site.
Mitigation strategies must focus on upgrading to version 4.2.2 or later where this issue has been resolved. For systems unable to upgrade immediately, implementing strict input validation for dashboard configuration data is essential. Developers should ensure that keys used in object property assignments are validated against known prototype pollution vectors such as _proto_, constructor, and prototype. Additionally, using Object.create(null) to create objects without a prototype chain can prevent inheritance-based attacks. Enforcing Content Security Policy headers may also help mitigate the impact by restricting script execution contexts, although direct remediation of the library version remains the most effective defense against this specific vulnerability class aligned with CWE-1321 Prototype Pollution and ATT&CK techniques related to configuration manipulation.