Read the docs
TI-2026-82135 Aliases CVE-2026-118249GHSA-gfvx-2c2g-38wq

Prototype pollution in Highcharts series column construction

Priority LOW 32CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Highcharts JS from 13.0.0 before 13.1.0 builds series data columns by using point option keys directly as column IDs, which is a prototype pollution flaw (CWE-1321). Own enumerable __proto__ and constructor keys in parsed point objects can direct integer-indexed writes to Object.prototype or the Object constructor. An attacker with low privileges can do this without user interaction beyond rendering the chart, and the inherited values affect reads and for-in enumeration across the page, which can disrupt rendering or alter consuming application behavior.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Fix Fixed highcharts (highcharts): 13.1.0highcharts (npm): 13.1.0

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
highchartshighcharts13.0.0 to before 13.1.013.1.0Patch availableCNA
—highcharts (npm)13.0.0 to before 13.1.013.1.0Patch availableGHSA-gfvx-2c2g-38wq
  • highcharts Vendorhighcharts Affected 13.0.0 to before 13.1.0 Fixed in 13.1.0 Patch available CNA
  • highcharts (npm) Vendor— Affected 13.0.0 to before 13.1.0 Fixed in 13.1.0 Patch available GHSA-gfvx-2c2g-38wq

Remediation

Upgrade the highcharts npm package to 13.1.0, which fixes this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA highcharts (highcharts) Fixed in 13.1.0
  • Fix · GHSA-gfvx-2c2g-38wq highcharts (npm) Fixed in 13.1.0 Advisory →

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118249
  2. 2026-10-28 Alias added: GHSA-gfvx-2c2g-38wq
  3. 2026-10-28 Fix available: npm/[email protected] · GHSA-gfvx-2c2g-38wq
  4. 2026-10-28 CVSS score added · GHSA-gfvx-2c2g-38wq
  5. 2026-10-28 Weakness changed · GHSA-gfvx-2c2g-38wq
  6. 2026-10-28 6 new references · GHSA-gfvx-2c2g-38wq
  7. 2026-10-29 CISA SSVC decision points changed
  8. 2026-10-29 Priority changed: MEDIUM → LOW

References

Advisory 1

Other 5

  • TI-2026-82141 Highcharts Grid parses pagination language options as HTML CVSS 4.0HIGH 8.6
  • TI-2026-82140 Cross-site scripting in Highcharts Dashboards fullscreen labels CVSS 4.0HIGH 8.4
  • TI-2026-82139 Cross-site scripting in Highcharts Dashboards sidebar labels CVSS 4.0HIGH 8.4
  • TI-2026-82131 Cross-site scripting in Highcharts Dashboards via chartConstructor CVSS 4.0HIGH 8.6
  • TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
  • TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences