CVE-2026-118249 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JavaScript library versions ranging from 13.0.0 to 13.1.0 represents a critical prototype pollution flaw rooted in improper handling of untrusted input during data parsing operations. As a widely adopted charting library that relies on SVG for rendering visualizations, Highcharts processes user-supplied or application-generated point objects to construct series data columns. In the affected versions, the internal logic directly utilizes keys from these parsed point objects as identifiers for column IDs without sufficient sanitization or validation of their origin and structure. This architectural decision creates a pathway for malicious actors to inject properties into JavaScript's global Object prototype through standard inheritance mechanisms when specific key names are used in the input data.
The technical mechanism of this flaw exploits how JavaScript handles object property assignment, specifically targeting integer-indexed writes that resolve against Object.prototype or the Object constructor itself. When an attacker supplies a point object containing enumerable keys such as _proto_ or constructor, the library's code interprets these strings literally and attempts to assign values associated with them directly onto the prototype chain rather than treating them as regular data points. Because JavaScript objects inherit properties from their prototypes, any modification to Object.prototype affects all subsequent object instantiations within the same execution context. This means that once the pollution occurs, every new object created in the application inherits these maliciously injected properties, leading to widespread state corruption across the entire page or web application environment.
The operational impact of this prototype pollution is severe and multifaceted, extending beyond simple rendering errors to potential remote code execution scenarios depending on how the polluted values are consumed by downstream logic. The inherited values disrupt normal chart rendering processes, causing visual anomalies or complete failure of data visualization components. More critically, because these altered properties persist across object reads and for-in enumerations, they can alter application behavior in unpredictable ways. If other parts of the application rely on standard object structures that have been compromised by this pollution, it may lead to logic bypasses, privilege escalation within the client-side context, or denial of service conditions where critical functions fail due to unexpected property values being present on base objects.
This vulnerability aligns with Common Weakness Enumeration (CWE) category CWE-1325, which covers improper check for unusual input that allows prototype pollution, and is closely related to CWE-915 regarding Improperly Controlled Modification of Dynamically-Determined Object Attributes. From a threat modeling perspective utilizing the MITRE ATT&CK framework, this flaw facilitates initial access or persistence techniques where an attacker can manipulate application state without direct user interaction beyond triggering the chart rendering process. The lack of explicit validation for prototype-related keys allows attackers to achieve their objectives passively by simply providing crafted data payloads that are rendered automatically upon page load or component initialization.
Mitigation strategies primarily involve upgrading to Highcharts version 13.1.0, where this issue has been resolved through improved input sanitization and stricter handling of object property assignments. For applications unable to immediately upgrade, defensive coding practices should be implemented to sanitize incoming data before it reaches the charting library. This includes validating that point objects do not contain keys such as _proto_, constructor, or isPrototypeOf, either by filtering these properties out during preprocessing or by using Object.create(null) for internal object creation where possible to break prototype chains. Additionally, implementing Content Security Policy headers can help mitigate potential downstream exploitation vectors by restricting the execution of inline scripts and limiting data sources, thereby reducing the attack surface available to adversaries attempting to leverage this vulnerability for broader system compromise.