CVE-2026-118243 · GHSA-jqgh-w3cc-7jqw

Highcharts Dashboards: `proto` data table id writes sync listeners to `Object.prototype`

Risk score: 42/100
CVSS: 5.3 v4.0
Exploit chance (30 days): 0.4%
Published: 28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is: Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates…
Affected: @highcharts/dashboards (npm) >= 1.0.0, <= 4.2.1
Fix: Upgrade @highcharts/dashboards to 4.2.2 or later.
Exploitation: No known exploitation

Story map

Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

@highcharts/dashboards: Amber, patch this week. Highcharts Dashboards parses fullscreen labels as HTML, allowing an attacker to execute code in the hosting page origin when edit mode is enabled. This could lead to arbitrary code execution.

The flaws

CVE-2026-118243: Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` (CVSS 5.3 · EPSS 0%)
CVE-2026-118253: Highcharts Dashboards parses fullscreen labels as HTML (CVSS 8.4 · EPSS 0%)
CVE-2026-118252: Highcharts Dashboards parses sidebar component labels as HTML (CVSS 8.4 · EPSS 0%)
CVE-2026-118245: Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace (CVSS 8.6 · EPSS 0%)

The fix

Upgrade @highcharts/dashboards: 4.2.2 · 4.2.3 or later on your release line

Who is exposed: {'products': ['Highcharts JS'], 'packages': ['@highcharts/dashboards'], 'versions': ['>= 1.0.0, < 4.2.3']}

Where it stands

No known exploitation

Connects to

Same weakness: Prototype pollution (CWE-1321). 49 other warnings in 30 days

Why it is Yellow

CVSS 5.3 medium
On your watchlist: npm

Affected packages

Package	Ecosystem	Vulnerable	Fixed in
@highcharts/dashboards	npm	>= 1.0.0, <= 4.2.1	4.2.2

References

Original description

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates an enumerable property there whose suffix can be influenced through the sync group option. The property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and an enabled component sync, but no user interaction beyond loading the board. This issue is fixed in 4.2.2.

Last activity 28 Oct 2026. Patch Forecast updates every hour.

Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`