CVE-2026-118249

    Dashboard / Vulnerabilities / CVE-2026-118249

    CVE-2026-118249

    Published: 28 Oct 2026Last Modified: 31 Oct 2026

    Summary: Highcharts: series column construction writes to Object.prototype

    Details: Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.

    References: https://github.com/highcharts/highcharts/releases/tag/v13.1.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118249.json, https://github.com/highcharts/highcharts/security/advisories/GHSA-gfvx-2c2g-38wq, https://nvd.nist.gov/vuln/detail/CVE-2026-118249, https://github.com/highcharts/highcharts/commit/d3357705c8f348904441327e32f50ab528c3a205, https://github.com/highcharts/highcharts/pull/25321

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e44b0e19db9affdb85b667524365d268c314b957
    Fixed -5d3e905ce2e2c75c174c06cf8dee0f00a5e02841

    Affected versions

    v13.0.0
    v13.0.2
    v13.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118249 | CVE-DB