Read the docs
TI-2026-82136 Aliases CVE-2026-118250GHSA-rmqc-xvr3-v46c

Prototype pollution in Highcharts via dotted series.keys paths

Priority LOW 34CWE-1321Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
Low · High · High
Fix status
Fixed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and GitHub.

Summary

Highcharts JS from 6.1.0 before 11.4.9, from 12.0.0 before 12.6.1, and from 13.0.0 before 13.1.0 follows dot-separated series.keys paths without filtering each segment. A __proto__ segment in such a path lets an attacker who controls series.keys and matching point data assign arbitrary named properties to Object.prototype, a prototype pollution flaw (CWE-1321). The properties are visible to all JavaScript on the page, and no user interaction is needed beyond rendering the chart.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

Description from the CNA

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00363 30th percentileScored 2026-11-07
Fix Fixed highcharts (highcharts): 11.4.9, 12.6.1, 13.1.0highcharts (npm): 12.6.1, 13.1.0, 11.4.9

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
highchartshighcharts6.1.0 to before 11.4.9; 12.0.0 to before 12.6.1; 13.0.0 to before 13.1.011.4.9, 12.6.1, 13.1.0Patch availableCNA
—highcharts (npm)12.0.0 to before 12.6.112.6.1Patch availableGHSA-rmqc-xvr3-v46c
—highcharts (npm)13.0.0 to before 13.1.013.1.0Patch availableGHSA-rmqc-xvr3-v46c
—highcharts (npm)6.1.0 to before 11.4.911.4.9Patch availableGHSA-rmqc-xvr3-v46c
  • highcharts Vendorhighcharts Affected 6.1.0 to before 11.4.9; 12.0.0 to before 12.6.1; 13.0.0 to before 13.1.0 Fixed in 11.4.9, 12.6.1, 13.1.0 Patch available CNA
  • highcharts (npm) Vendor— Affected 12.0.0 to before 12.6.1 Fixed in 12.6.1 Patch available GHSA-rmqc-xvr3-v46c
  • highcharts (npm) Vendor— Affected 13.0.0 to before 13.1.0 Fixed in 13.1.0 Patch available GHSA-rmqc-xvr3-v46c
  • highcharts (npm) Vendor— Affected 6.1.0 to before 11.4.9 Fixed in 11.4.9 Patch available GHSA-rmqc-xvr3-v46c

Remediation

Upgrade the highcharts npm package to 11.4.9, 12.6.1 or 13.1.0, the versions that fix this issue.

Written with Claude Haiku 5.5 from the sources below · 2026-11-04

  • Fix · CNA highcharts (highcharts) Fixed in 11.4.9, 12.6.1, 13.1.0
  • Fix · GHSA-rmqc-xvr3-v46c highcharts (npm) Fixed in 12.6.1 Advisory →
  • Fix · GHSA-rmqc-xvr3-v46c highcharts (npm) Fixed in 13.1.0 Advisory →
  • Fix · GHSA-rmqc-xvr3-v46c highcharts (npm) Fixed in 11.4.9 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 4 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Enterprise Linux AI (RHEL AI) 3

Timeline

  1. 2026-10-28 Threatist record created from CVE-2026-118250
  2. 2026-10-28 Alias added: GHSA-rmqc-xvr3-v46c
  3. 2026-10-28 Fix available: npm/[email protected], npm/[email protected], npm/[email protected] · GHSA-rmqc-xvr3-v46c
  4. 2026-10-28 CVSS score added · GHSA-rmqc-xvr3-v46c
  5. 2026-10-28 Weakness changed · GHSA-rmqc-xvr3-v46c
  6. 2026-10-28 6 new references · GHSA-rmqc-xvr3-v46c
  7. 2026-10-30 Priority changed: MEDIUM → LOW
  8. 2026-11-03 CISA SSVC decision points changed
  9. 2026-11-04 Affected versions changed · Red Hat
  10. 2026-11-04 CVSS score added · Red Hat

References

Advisory 1

Other 5

  • TI-2026-82141 Highcharts Grid parses pagination language options as HTML CVSS 4.0HIGH 8.6
  • TI-2026-82140 Cross-site scripting in Highcharts Dashboards fullscreen labels CVSS 4.0HIGH 8.4
  • TI-2026-82139 Cross-site scripting in Highcharts Dashboards sidebar labels CVSS 4.0HIGH 8.4
  • TI-2026-82131 Cross-site scripting in Highcharts Dashboards via chartConstructor CVSS 4.0HIGH 8.6
  • TI-2026-82128 Cross-site scripting in Highcharts Grid icon definitions CVSS 4.0HIGH 8.5
  • TI-2026-82125 Cross-site scripting in Highcharts Grid Pro cell renderer attributes CVSS 4.0HIGH 8.5
See all 17 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences