Highcharts up to 4.2.1 Dashboards editableOptions prototype pollution

Summaryinfo

A vulnerability identified as critical has been detected in Highcharts up to 4.2.1. Affected by this issue is some unknown functionality of the component Dashboards. This manipulation of the argument editableOptions causes prototype pollution. This vulnerability appears as CVE-2026-118248. The attack may be initiated remotely. There is no available exploit. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Highcharts up to 4.2.1 and classified as critical. Affected by this vulnerability is some unknown functionality of the component Dashboards. The manipulation of the argument editableOptions with an unknown input leads to a prototype pollution vulnerability. The CWE definition for the vulnerability is CWE-1321. The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2026-118248 since 10/27/2026. The exploitation appears to be easy. The attack can be launched remotely. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1059 according to MITRE ATT&CK.

Upgrading to version 4.2.2 eliminates this vulnerability.

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Highcharts

Version

• 4.2.0
• 4.2.1

Website

• Product: https://github.com/highcharts/highcharts/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion