{"schema":"threatline.record/2","record":{"id":"CVE-2026-118249","aliases":["GHSA-gfvx-2c2g-38wq"],"summary":"Highcharts: series column construction writes to Object.prototype","details":"### Impact\nWhen series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches `Object.prototype` and the `Object` constructor. Keys named `__proto__` and `constructor` survive `JSON.parse` as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on `Object.prototype`, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the attacker's value, and `for...in` over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. The properties remain in place once the chart has been built, and no user interaction is required beyond rendering the chart.\n\nConsequences beyond disruption depend on the consuming application.\n\n### Workarounds\nDrop-in fix - for any versions affected (6.1.0-13.0.2).\nAdd the below IIFE to run after Highcharts is loaded.\n\n```javascript\n;!function(t){if(t&&t.Point&&!t.Point.prototype.protoPollutionPatched){var o=t.Point.prototype,r=o.optionsToObject,e=o.setNestedProperty,n=Object.prototype.hasOwnProperty;o.optionsToObject=function(t){if(t&&\"object\"==typeof t&&!Array.isArray(t)&&(n.call(t,\"__proto__\")||n.call(t,\"constructor\"))){var o={};for(var e in t)n.call(t,e)&&!c(e)&&(o[e]=t[e]);t=o}return r.call(this,t)},o.setNestedProperty=function(t,o,r){return String(r).split(\".\").some(c)?t:e.call(this,t,o,r)},o.protoPollutionPatched=!0}function c(t){return\"__proto__\"===t||\"constructor\"===t}}(Highcharts);\n```\n\n[Live demo & testing](https://jsfiddle.net/BlackLabel/nopc6vhj/)\n\n### Obtaining the patched version\nThe patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install highcharts@13.1.0`. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example `https://code.highcharts.com/13.1.0/highcharts.js`. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/getting-started/installation).","categories":["Libraries & packages"],"product":"highcharts","vendor":"highcharts","ecosystem":"npm","affected_ranges":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-gfvx-2c2g-38wq","source_modified_at":"2026-10-28T19:56:15Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"npm","name":"highcharts"},"range":">= 13.0.0, <= 13.0.2"},{"source":"CVE List","source_url":"https://www.cve.org/CVERecord?id=CVE-2026-118249","source_modified_at":"2026-10-28T17:57:18.323Z","fetched_at":"2026-10-28T20:58:01.013507Z","product":"highcharts","vendor":"highcharts","versions":[{"version":">= 13.0.0, < 13.1.0","status":"affected"}],"defaultStatus":null},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-gfvx-2c2g-38wq","source_modified_at":"2026-10-28T20:15:06.101208831Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"highcharts","ecosystem":"npm","purl":"pkg:npm/highcharts"},"ranges":[{"type":"SEMVER","events":[{"introduced":"13.0.0"},{"fixed":"13.1.0"}]}],"versions":[]}],"fixed_versions":[{"source":"GitHub Advisory Database","source_url":"https://github.com/advisories/GHSA-gfvx-2c2g-38wq","source_modified_at":"2026-10-28T19:56:15Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"ecosystem":"npm","name":"highcharts"},"version":"13.1.0"},{"source":"OSV","source_url":"https://osv.dev/vulnerability/GHSA-gfvx-2c2g-38wq","source_modified_at":"2026-10-28T20:15:06.101208831Z","fetched_at":"2026-10-28T20:58:01.013507Z","package":{"name":"highcharts","ecosystem":"npm","purl":"pkg:npm/highcharts"},"version":"13.1.0"}],"cvss":7.1,"severity":"High","kev":{"listed":false},"epss":{"probability":null,"percentile":null,"score_date":null},"published_at":"2026-10-28T17:57:18.323Z","modified_at":"2026-10-28T20:15:06.101208831Z","provenance":[{"source":"GitHub Advisory Database","url":"https://github.com/advisories/GHSA-gfvx-2c2g-38wq","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T19:56:15Z"},{"source":"CVE List","url":"https://www.cve.org/CVERecord?id=CVE-2026-118249","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T17:57:18.323Z"},{"source":"OSV","url":"https://osv.dev/vulnerability/GHSA-gfvx-2c2g-38wq","fetched_at":"2026-10-28T20:58:01.013507Z","source_modified_at":"2026-10-28T20:15:06.101208831Z"}],"sources":["GitHub Advisory Database","CVE List","OSV"],"references":[{"source":"CVE List","url":"https://github.com/highcharts/highcharts/security/advisories/GHSA-gfvx-2c2g-38wq","tags":["x_refsource_CONFIRM"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118249","source":"GitHub Advisory Database"},{"source":"CVE List","url":"https://github.com/highcharts/highcharts/pull/25321","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/highcharts/highcharts/commit/d3357705c8f348904441327e32f50ab528c3a205","tags":["x_refsource_MISC"]},{"source":"CVE List","url":"https://github.com/highcharts/highcharts/releases/tag/v13.1.0","tags":["x_refsource_MISC"]},{"url":"https://github.com/advisories/GHSA-gfvx-2c2g-38wq","source":"GitHub Advisory Database"}],"locations":[],"motoko_assessment":{"status":"requires_architecture_review","automatic_remediation":false},"cve_state":"PUBLISHED","classification":{"method":"product-first software-layer rules","rules_version":"2.1","matched_on":"ecosystem","confidence":"heuristic","reviewed":false},"change_timestamp":"2026-10-28T20:15:06.101208831Z","content_hash":"75dc41d257dbb165997ebcdf816e9653a2a64cb180afe9e461ceeff442fbd201"}}