CVE-2026-118250 · GHSA-rmqc-xvr3-v46c
Highcharts: dotted series.keys paths write to Object.prototype
- Risk score
- 48/100
- CVSS
- 7.2 v4.0
- Published
- 28 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties …
- Affected
- highcharts (npm) >= 12.0.0, < 12.6.1; highcharts (npm) >= 13.0.0, <= 13.0.2; highcharts (npm) >= 6.1.0, < 11.4.9
- Fix
- Upgrade highcharts to 12.6.1 or 13.1.0 or 11.4.9 (whichever matches your release line) or later.
- Exploitation
- No known exploitation
Story map
At a glance
highcharts: Yellow, plan it in. Highcharts JS is a JavaScript charting library based on SVG. From 10.0.0 until 11.4.9, 12.6.1, and 13.1.0, Highcharts applies breadcrumbs.style as SVG attributes rather than CSS and does not filter the attribute names. An attacker who controls chart configuration can provide event-handler keys through drilldown.breadc…
The flaws
- CVE-2026-118250: Highcharts: dotted series.keys paths write to Object.prototype (CVSS 7.2)
- CVE-2026-118246: Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes (CVSS 8.4)
- CVE-2026-118251: Highcharts: `javascript:` URL in credits.href runs script on click (CVSS 8.4)
- CVE-2026-116796: Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering and reaches exported charts (CVSS 7.2)
The fix
Upgrade highcharts: 11.4.9 · 12.6.1 · 3.1.0 · 13.1.0 · 12.6.2 · 13.1.1 or later on your release line
Who is exposed: highcharts (npm) >= 10.0.0, < 11.4.9; highcharts (npm) >= 12.0.0, < 12.6.1; highcharts (npm) >= 13.0.0, <= 13.0.2
Where it stands
- No known exploitation
Connects to
- Same weakness: Prototype pollution (CWE-1321). 48 other warnings in 30 days
Why it is Yellow
- CVSS 7.2 high
- On your watchlist: npm
Affected packages
| Package | Ecosystem | Vulnerable | Fixed in |
|---|---|---|---|
| highcharts | npm | >= 12.0.0, < 12.6.1 | 12.6.1 |
| highcharts | npm | >= 13.0.0, <= 13.0.2 | 13.1.0 |
| highcharts | npm | >= 6.1.0, < 11.4.9 | 11.4.9 |
References
- https://github.com/highcharts/highcharts/commit/fd4ee8140732618bbe71295aba55398fb1f8fa9e
- https://github.com/highcharts/highcharts/pull/25313
- https://github.com/highcharts/highcharts/releases/tag/v13.1.0
- https://github.com/highcharts/highcharts/security/advisories/GHSA-rmqc-xvr3-v46c
- https://github.com/advisories/GHSA-rmqc-xvr3-v46c
- https://nvd.nist.gov/vuln/detail/CVE-2026-118250
- https://github.com/advisories/GHSA-rmqc-xvr3-v46c
Original description
Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.
Last activity 28 Oct 2026. Patch Forecast updates every hour.