CVE-2026-118250
HighCVSS 7.2Exploitation Probability (EPSS)
Low risk30th percentile - higher than 30% of all known CVEs
Summary
Highcharts JS from 6.1.0 until 11.4.9, 12.6.1, and 3.1.0 follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype, visible to all JavaScript in the page, with no user interaction beyond rendering the chart.
Risk Assessment
This could lead to prototype pollution, potentially disrupting application behavior or enabling malicious code execution in the user's browser.
Recommendation
Update Highcharts to version 11.4.9, 12.6.1, or 3.1.0, which fix the vulnerability.
Other vulnerabilities in Highcharts JS
See all- CVE-2026-118249High
Highcharts JS from 13.0.0 until 13.1.0 builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor, affecting reads and for-in enumeration across the page without user interaction beyond rendering the chart.
- CVE-2026-118246High
Highcharts JS from 10.0.0 until 11.4.9, 12.6.1, and 13.1.0 applies breadcrumbs.style as SVG attributes rather than CSS and does not filter attribute names. An attacker who controls chart configuration can provide event-handler keys through breadcrumb options, which become active handlers on the breadcrumb button and execute in the hosting page origin after the user navigates and hovers over or activates the button.
- CVE-2026-118244High
Highcharts JS from 12.0.0 until 12.6.1 and 13.1.0 falls back to assigning raw markup to innerHTML when DOMParser cannot return a document, before its allow-list is applied. In Chromium, the Trusted Types callback can throw while a beforeprint handler runs, so a page that redraws a chart during beforeprint can insert untrusted HTML text options into the hosting document, and event handlers in that markup run in the page origin when printing begins.
Original NVD description (English source)
Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS