CVE-2026-118248 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JS versions ranging from 1.0.0 through 4.2.2 represents a critical prototype pollution flaw located specifically within the dashboard editing functionality. The core technical defect arises during the processing of editable options, where the library iterates over property path segments without implementing adequate validation to reject keys associated with JavaScript object prototypes. Specifically, when an attacker gains control over the editableOptions configuration structure, they can inject malicious paths utilizing _proto_ or constructor properties. This allows for direct manipulation of the base Object prototype rather than just the intended target data structures.
From a technical perspective, this flaw exploits the way JavaScript handles property inheritance and lookup chains. By writing a value to Object.prototype via the unvalidated path traversal, the injected property becomes universally accessible across all objects instantiated within the same execution context on the page. This mechanism bypasses standard encapsulation boundaries because every subsequent object creation inherits these polluted properties unless explicitly overridden. The severity of this issue is heavily dependent on how the consuming application utilizes JavaScript prototypes and whether it relies on prototype-based inheritance for critical functionality or security checks.
The operational impact of this vulnerability extends beyond simple data corruption, potentially leading to severe client-side attacks such as Cross-Site Scripting if the polluted property influences rendering logic or event handlers. Furthermore, attackers can alter default behaviors of built-in objects, effectively changing how methods like toString, hasOwnProperty, or valueOf behave for all instances in the scope. This can lead to denial of service conditions by breaking core JavaScript functionality or facilitate further exploitation vectors where application logic assumes standard prototype behavior that no longer holds true due to the pollution.
This vulnerability aligns with CWE-1321: Improperly Controlled Modification of Object Prototype Attributes, commonly referred to as Prototype Pollution. In terms of offensive security frameworks, it maps to MITRE ATT&CK techniques involving client-side code injection and potentially data manipulation through DOM-based vectors if the dashboard interface is exposed via a web UI that allows user-supplied configuration inputs. The lack of input validation on prototype-related keys constitutes an insufficient access control mechanism within the library's internal logic for handling dynamic property paths.
Mitigation strategies primarily involve upgrading to Highcharts version 4.2.2 or later, where this specific path traversal vulnerability has been addressed by implementing strict checks against prototype pollution vectors during the editing process. For applications unable to upgrade immediately, defensive coding practices should be employed, such as freezing Object.prototype using Object.freeze() in a secure environment before loading the library, thereby preventing any modifications to the prototype chain. Additionally, developers should ensure that any user-controlled data passed into Highcharts configuration objects is sanitized and validated against known dangerous keys like _proto_, constructor, and prototype before being processed by the charting engine.