Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118249— Highcharts: series column construction writes to Object.prototype

Quick assessment

Affected

highcharts highcharts

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Highcharts JS 是一个基于 SVG 的 JavaScript 图表库。在 13.0.0 至 13.1.0 版本中，Highcharts 在构建系列数据列时，直接将点（point）选项的键名用作列 ID。因此，解析后的点对象中自定义的可枚举和键，可引导对或构造函数的按整数索引的写入操作。这些被继承的值会影响页面上的读取操作及枚举，从而破坏渲染效果或改变应用程序的行为，且无需用户除渲染图表之外的任何交互。该问题已在 13.1.0 版本中修复。

CVSS 7.2 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 1

Vendor	Product	Version Range	Status
highcharts	highcharts	`>= 13.0.0, < 13.1.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Highcharts: series column construction writes to Object.prototype

Source: CVE Program / CVE List V5

Vulnerability Description

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1321

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
highcharts	highcharts	>= 13.0.0, < 13.1.0	-

II. Public POCs for CVE-2026-118249

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118249

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118249 (2)

Vendor Advisories for CVE-2026-118249 (1)

🔗 Core: series column construction writes to Object.prototype · Advisory · highcharts/highcharts · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-118249 (1)

🔗 Release v13.1.0 · highcharts/highcharts · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118249

Same Patch Batch · highcharts · 2026-10-28 · 16 CVEs total

CVE-2026-118245	8.6 HIGH	Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts names
CVE-2026-118254	8.6 HIGH	Highcharts Grid: pagination language options are parsed as HTML
CVE-2026-116797	8.5 HIGH	Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
CVE-2026-118242	8.5 HIGH	Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>
CVE-2026-118246	8.4 HIGH	Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
CVE-2026-118253	8.4 HIGH	Highcharts Dashboards: fullscreen labels are parsed as HTML
CVE-2026-118251	8.4 HIGH	Highcharts: javascript: URL in credits.href runs script on click
CVE-2026-118252	8.4 HIGH	Highcharts Dashboards: sidebar component labels are parsed as HTML
CVE-2026-118255	8.4 HIGH	Highcharts Grid: javascript: URL in credits.href runs script on click
CVE-2026-116796	7.2 HIGH	Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering an
CVE-2026-118244	7.2 HIGH	Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during
CVE-2026-118250	7.2 HIGH	Highcharts: dotted series.keys paths write to Object.prototype
CVE-2026-118247	6.9 MEDIUM	Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__`
CVE-2026-118248	6.9 MEDIUM	Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
CVE-2026-118243	5.3 MEDIUM	Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototyp

IV. Related Vulnerabilities

Same product: highcharts

Same vendor: highcharts

Same weakness: CWE-1321