CVE-2026-118250

    Dashboard / Vulnerabilities / CVE-2026-118250

    CVE-2026-118250

    Published: 28 Oct 2026Last Modified: 5 Nov 2026

    Summary: Highcharts: dotted series.keys paths write to Object.prototype

    Details: Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.

    References: https://github.com/highcharts/highcharts/releases/tag/v13.1.0, https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118250.json, https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c, https://nvd.nist.gov/vuln/detail/CVE-2026-118250, https://github.com/highcharts/highcharts/commit/fd4ee8140732618bbe71295aba55398fb1f8fa9e, https://github.com/highcharts/highcharts/pull/25313

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- e44b0e19db9affdb85b667524365d268c314b957
    Fixed -5d3e905ce2e2c75c174c06cf8dee0f00a5e02841

    Affected versions

    v13.0.0
    v13.0.2
    v13.0.1

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2026-118250 | CVE-DB