CVE-2026-118250 in Highcharts
Summary
by MITRE • 10/28/2026
Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/28/2026
The vulnerability identified within Highcharts JS versions ranging from 6.1.0 through specific releases including 11.4.9, 12.6.1, and 3.1.0 represents a critical prototype pollution issue rooted in the library's handling of data serialization paths. Highcharts is widely utilized for rendering interactive charts using SVG or canvas technologies, often processing complex datasets provided by backend systems or user inputs. The core technical flaw lies in how the library processes dot-separated series keys when mapping them to point data structures. Specifically, the code traverses these key segments without implementing sufficient validation or filtering mechanisms to ensure that each segment represents a safe property name on an object instance rather than a path leading to internal prototype chains.
When an attacker gains control over the series.keys configuration and can supply corresponding malicious point data, they are able to exploit this lack of input sanitization by injecting a key sequence containing _proto_. In JavaScript environments, accessing or modifying properties via _proto_ allows direct manipulation of Object.prototype. By assigning arbitrary named properties through this vector, the attacker effectively pollutes the global object prototype. This means that any new object created in the page context after the pollution occurs will inherit these malicious properties as its own. Because no user interaction is required beyond the initial rendering of the chart, which typically happens automatically upon loading a dashboard or report containing the vulnerable Highcharts instance, this vulnerability can be triggered remotely and silently against unsuspecting users who visit the affected webpage.
The operational impact of such prototype pollution is severe and multifaceted. Since JavaScript objects inherit properties from their prototypes, the injected malicious properties become visible to all subsequent code execution within the page context. This can lead to a variety of downstream attacks depending on how other scripts in the application interact with standard object structures. For instance, if an existing script checks for specific configuration flags or data attributes using property accessors like obj.key, it may inadvertently retrieve the attacker-controlled values instead of expected defaults or legitimate data. This discrepancy can cause logic errors, bypass security controls that rely on these properties, or facilitate further exploitation vectors such as Cross-Site Scripting (XSS) if the polluted properties are later reflected into HTML contexts without proper encoding. The persistence of this state across object instantiations makes it particularly dangerous in single-page applications where data structures are frequently reused and extended.
From a classification perspective, this vulnerability aligns with CWE-1325, which covers Incorrectly Controlled Modification of Object Prototype Attributes, often referred to as JavaScript Prototype Pollution. It also maps to the MITRE ATT&CK technique T1078, specifically Valid Accounts or Default Accounts if exploited via compromised credentials, but more accurately relates to client-side code injection and logic manipulation techniques found in web application attacks. The lack of input validation on critical path segments is a common pattern in such vulnerabilities, highlighting the importance of strict schema enforcement when processing dynamic data structures derived from external sources.
To mitigate this vulnerability, organizations must upgrade Highcharts JS immediately to version 11.4.9, 12.6.1, or 3.1.0 and later, where the developers have implemented safeguards against prototype pollution by filtering out dangerous path segments like _proto_. For applications unable to update immediately due to legacy constraints, defensive coding practices should be employed. This includes implementing custom sanitization logic that intercepts data processing before it reaches Highcharts configuration objects, ensuring that any key paths are validated against a whitelist of allowed property names or explicitly blocked if they contain reserved prototype identifiers. Additionally, developers should consider using Object.create(null) for creating temporary lookup tables to avoid inheriting from Object.prototype by default, thereby reducing the attack surface even in older library versions where such protections may not be present. Regular security audits focusing on data binding and serialization processes are essential to prevent similar issues arising from other third-party libraries or custom implementations that handle dynamic object construction.