Read the docs
TI-2026-82133 Aliases CVE-2026-118247GHSA-c75x-9x9h-28rm

Prototype pollution in Highcharts DataTable setCell

Priority LOW 36CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
Active
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Highcharts Dashboards from 1.0.0 before 4.2.2 and Grid Pro from 2.0.0 before 3.2.0 are affected. DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ (CWE-1321). An attacker who controls a column ID and can make a cell, point or API write can set values on Object.prototype, which alters array and object reads and for-in loops across the page. This can change application control flow or disrupt rendering.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

Description from the CNA

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and Grid Pro editing paths, can therefore write integer-indexed values onto Object.prototype or the Object constructor. In Dashboards releases with column aliases, a literal __proto__ ID is redirected by the alias map, while an alias targeting __proto__ reaches the unsafe write; later releases without aliases accept the unsafe ID directly. Those inherited values affect array and object reads and for-in enumeration throughout the page, which can alter application control flow or disrupt rendering. Exploitation requires control of the table or component column ID and a cell, point, or API write. This issue is fixed in Dashboards 4.2.2 and Grid Pro 3.2.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Fix Fixed highcharts (highcharts): 13.1.0dashboards (@highcharts): 4.2.3+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
highchartshighchartsbefore 13.1.013.1.0Patch availableCNA
highchartsdashboards1.0.0 to before 4.2.34.2.3Patch availableCNA
highchartsgrid-pro2.0.0 to before 3.2.03.2.0Patch availableCNA
—@highcharts/dashboards (npm)1.0.0 to before 4.2.24.2.2Patch availableGHSA-c75x-9x9h-28rm
—@highcharts/grid-pro (npm)2.0.0 to before 3.2.03.2.0Patch availableGHSA-c75x-9x9h-28rm
  • highcharts Vendorhighcharts Affected before 13.1.0 Fixed in 13.1.0 Patch available CNA
  • dashboards Vendorhighcharts Affected 1.0.0 to before 4.2.3 Fixed in 4.2.3 Patch available CNA
  • grid-pro Vendorhighcharts Affected 2.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available CNA
  • @highcharts/dashboards (npm) Vendor— Affected 1.0.0 to before 4.2.2 Fixed in 4.2.2 Patch available GHSA-c75x-9x9h-28rm
  • @highcharts/grid-pro (npm) Vendor— Affected 2.0.0 to before 3.2.0 Fixed in 3.2.0 Patch available GHSA-c75x-9x9h-28rm

Remediation

Upgrade @highcharts/dashboards to 4.2.2 and @highcharts/grid-pro to 3.2.0. The sources list no fixed version for highcharts.

Written with Claude Haiku 5.5 from the sources below · 2026-11-02

  • Fix · CNA highcharts (highcharts) Fixed in 13.1.0
  • Fix · CNA dashboards (@highcharts) Fixed in 4.2.3
  • Fix · CNA grid-pro (@highcharts) Fixed in 3.2.0
  • Fix · GHSA-c75x-9x9h-28rm @highcharts/dashboards (npm) Fixed in 4.2.2 Advisory →
  • Fix · GHSA-c75x-9x9h-28rm @highcharts/grid-pro (npm) Fixed in 3.2.0 Advisory →

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118247
  2. 2026-10-28 Alias added: GHSA-c75x-9x9h-28rm
  3. 2026-10-28 Fix available: npm/@highcharts/[email protected], npm/@highcharts/[email protected] · GHSA-c75x-9x9h-28rm
  4. 2026-10-28 CVSS score added · GHSA-c75x-9x9h-28rm
  5. 2026-10-28 Weakness changed · GHSA-c75x-9x9h-28rm
  6. 2026-10-28 6 new references · GHSA-c75x-9x9h-28rm
  7. 2026-10-30 Priority changed: MEDIUM → LOW
  8. 2026-11-02 CISA SSVC decision points changed

References

Advisory 1

Other 5

  • TI-2026-82141 Highcharts Grid parses pagination language options as HTML CVSS 4.0HIGH 8.6
  • TI-2026-82140 Cross-site scripting in Highcharts Dashboards fullscreen labels CVSS 4.0HIGH 8.4
  • TI-2026-82139 Cross-site scripting in Highcharts Dashboards sidebar labels CVSS 4.0HIGH 8.4
  • TI-2026-82131 Cross-site scripting in Highcharts Dashboards via chartConstructor CVSS 4.0HIGH 8.6
  • TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
  • TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences