Prototype pollution in Highcharts Dashboards data table IDs
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.
Summary
Highcharts Dashboards (@highcharts/dashboards on npm) from 1.0.0 before 4.2.2 is affected. A __proto__ data table ID supplied through dataPool connector configuration makes sync registration write an enumerable property to Object.prototype (CWE-1321). An attacker with low privileges who supplies untrusted dashboard configuration with component sync enabled can trigger it by loading the board. The polluted property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
Description from the CNA
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates an enumerable property there whose suffix can be influenced through the sync group option. The property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and an enabled component sync, but no user interaction beyond loading the board. This issue is fixed in 4.2.2.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Total
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| highcharts | highcharts | 1.0.0 to before 4.2.2 | 4.2.2 | Patch available | CNA |
| — | @highcharts/dashboards (npm) | 1.0.0 to before 4.2.2 | 4.2.2 | Patch available | GHSA-jqgh-w3cc-7jqw |
- highcharts Vendorhighcharts Affected 1.0.0 to before 4.2.2 Fixed in 4.2.2 Patch available CNA
- @highcharts/dashboards (npm) Vendor— Affected 1.0.0 to before 4.2.2 Fixed in 4.2.2 Patch available GHSA-jqgh-w3cc-7jqw
Remediation
Upgrade @highcharts/dashboards to version 4.2.2, which fixes this issue. The sources list no fixed version for highcharts.
Written with Claude Haiku 5.5 from the sources below · 2026-11-02
- Fix · CNA highcharts (highcharts) Fixed in 4.2.2
- Fix · GHSA-jqgh-w3cc-7jqw @highcharts/dashboards (npm) Fixed in 4.2.2 Advisory →
Timeline
- 2026-10-28 Threatist record created from CVE-2026-118243
- 2026-10-28 Alias added: GHSA-jqgh-w3cc-7jqw
- 2026-10-28 Fix available: npm/@highcharts/[email protected] · GHSA-jqgh-w3cc-7jqw
- 2026-10-28 CVSS score added · GHSA-jqgh-w3cc-7jqw
- 2026-10-28 Weakness changed · GHSA-jqgh-w3cc-7jqw
- 2026-10-28 5 new references · GHSA-jqgh-w3cc-7jqw
- 2026-11-02 CISA SSVC decision points changed
References
More highcharts vulnerabilities
- TI-2026-82141 Highcharts Grid parses pagination language options as HTML CVSS 4.0HIGH 8.6
- TI-2026-82140 Cross-site scripting in Highcharts Dashboards fullscreen labels CVSS 4.0HIGH 8.4
- TI-2026-82139 Cross-site scripting in Highcharts Dashboards sidebar labels CVSS 4.0HIGH 8.4
- TI-2026-82131 Cross-site scripting in Highcharts Dashboards via chartConstructor CVSS 4.0HIGH 8.6
- TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
- TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
Sources
- CVE-2026-118243 · CVE Program
- CVE-2026-118243 · NVD
- FIRST EPSS
- GHSA-jqgh-w3cc-7jqw · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences