Patch Forecast
Yellow warning
Plan into this sprint.

CVE-2026-118249 · GHSA-gfvx-2c2g-38wq

Highcharts: series column construction writes to Object.prototype

Risk score
48/100
CVSS
7.2 v4.0
Published
28 Oct 2026

Open in the live forecast Today's forecast

What to know

What it is
Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the …
Affected
highcharts (npm) >= 13.0.0, <= 13.0.2
Fix
Upgrade highcharts to 13.1.0 or later.
Exploitation
No known exploitation

Story map

Story map: highchartsTHE FLAWSTHE FIXCVE-2026-118249Highcharts: series columnconstruction writes toObject.prototypeCVSS 7.2CVE-2026-118246Highcharts Core:`breadcrumbs.style` keysbecome SVG event-handler…CVSS 8.4CVE-2026-118251Highcharts: `javascript:` URLin credits.href runs script onclickCVSS 8.4CVE-2026-116796Highcharts Core: `javascript:`URL in an `xlink:href`attribute survives text…CVSS 7.2Upgrade highcharts13.1.0 · 11.4.9 · 12.6.1 · 12.6.2 ·13.1.1or later on your release lineWho is exposedhighcharts (npm) >= 10.0.0, <11.4.9; highcharts (npm) >=12.0.0, < 12.6.1; highcharts (npm)>= 13.0.0, <= 13.0.2YELLOW · PLAN IT INhighchartsHighcharts JS is a JavaScriptcharting library based on SVG.From 10.0.0 until 11.4.9, 12.6.1,and 13.1.0, Highcharts appliesbreadcrumbs.style as SVGattributes rather than CSS anddoes not filter the attribute…Where it standsNo known exploitationCONNECTS TOSame weaknessPrototype pollution (CWE-1321)48 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

highcharts: Yellow, plan it in. Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadc…

The flaws

  • CVE-2026-118249: Highcharts: series column construction writes to Object.prototype (CVSS 7.2)
  • CVE-2026-118246: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes (CVSS 8.4)
  • CVE-2026-118251: Highcharts: `javascript:` URL in credits.href runs script on click (CVSS 8.4)
  • CVE-2026-116796: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts (CVSS 7.2)

The fix

Upgrade highcharts: 13.1.0 · 11.4.9 · 12.6.1 · 12.6.2 · 13.1.1 or later on your release line

Who is exposed: highcharts (npm) >= 10.0.0, < 11.4.9; highcharts (npm) >= 12.0.0, < 12.6.1; highcharts (npm) >= 13.0.0, <= 13.0.2

Where it stands

  • No known exploitation

Connects to

Why it is Yellow

  • CVSS 7.2 high
  • On your watchlist: npm

Affected packages

PackageEcosystemVulnerableFixed in
highchartsnpm>= 13.0.0, <= 13.0.213.1.0

References

Original description

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.

Last activity 28 Oct 2026. Patch Forecast updates every hour.