CVE-2026-118247 in Dashboards
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and Grid Pro editing paths, can therefore write integer-indexed values onto Object.prototype or the Object constructor. In Dashboards releases with column aliases, a literal __proto__ ID is redirected by the alias map, while an alias targeting __proto__ reaches the unsafe write; later releases without aliases accept the unsafe ID directly. Those inherited values affect array and object reads and for-in enumeration throughout the page, which can alter application control flow or disrupt rendering. Exploitation requires control of the table or component column ID and a cell, point, or API write. This issue is fixed in Dashboards 4.2.2 and Grid Pro 3.2.0.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JS libraries affects versions from 1.0.0 through Dashboards 4.2.2 and from 2.0.0 through Grid Pro 3.2.0, representing a critical prototype pollution flaw rooted in improper input validation during data binding operations. The core technical defect lies in the DataTable single-cell writer mechanism, which accepts an untrusted column identifier as a key for object property assignment without performing necessary sanitization checks against reserved JavaScript properties such as _proto_ or constructor. This oversight allows attackers to manipulate the internal state of native Object prototypes by writing values directly onto Object.prototype or the Object constructor itself through standard API endpoints like DataTable.setCell, which is utilized in both Dashboards connector write-back and Grid Pro editing workflows.
From a technical perspective, this flaw exploits the way JavaScript engines handle property lookup chains when specific keys are used as object indices. By injecting malicious payloads into column IDs that map to _proto_, an attacker can effectively alter the base prototype of all objects created subsequently within the same execution context. In Dashboards releases featuring column aliases, there was a partial mitigation where literal _proto_ identifiers were redirected by the alias mapping layer; however, if an alias itself targeted _proto_, it would still reach the unsafe write operation. Later releases that removed the aliasing feature accepted these dangerous IDs directly, leaving all affected versions vulnerable to this manipulation technique regardless of configuration settings regarding column naming conventions.
The operational impact of this vulnerability is severe due to its ability to alter application control flow and disrupt rendering across entire web pages. Once Object.prototype or constructor properties are modified, any subsequent array iteration, object property access, or for-in enumeration throughout the page will inherit these malicious values. This can lead to unpredictable behavior such as data corruption, logic bypasses in authentication or authorization checks if those rely on standard object methods, and potential denial of service conditions caused by infinite loops or memory exhaustion during rendering processes. The attack surface requires an attacker to have control over table column definitions and the ability to write cell values via API calls, points, or direct component editing interfaces, making it particularly dangerous in applications where user-generated content influences chart configurations.
This vulnerability aligns with CWE-1325, which describes improper check for unusual input leading to prototype pollution, and maps directly to MITRE ATT&CK technique T1098.004, specifically Account Manipulation via Cloud Accounts or more broadly Injection techniques that affect application logic through property manipulation. Mitigation strategies must prioritize immediate upgrading to Dashboards 4.2.2 or Grid Pro 3.2.0 where the issue has been resolved by implementing strict validation of column identifiers against reserved JavaScript keywords before they are used as object keys. For environments unable to upgrade immediately, defensive coding practices such as using Object.create(null) for data structures that act as maps, validating all incoming property names against a whitelist of safe characters and excluding prototype-related strings, and employing JSON.parse with reviver functions to sanitize inputs can provide temporary protection against exploitation attempts targeting this specific vector.