Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

Buy Us a Coffee

CVE-2026-118250— Highcharts: dotted series.keys paths write to Object.prototype

Quick assessment

Affected

highcharts highcharts

Exploitation

No confirmed in-the-wild exploitation; assess based on exposure

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Highcharts JS 是一个基于 SVG 的 JavaScript 图表库。在版本 6.1.0 至 11.4.9、12.6.1 和 3.1.0 期间，Highcharts 在解析由点分隔的路径时，未对路径的每一段进行过滤。如果攻击者能够控制及对应的数据点，便可通过路径向分配任意命名的属性。这些属性会对页面上的所有 JavaScript 代码可见，且除了渲染图表外，无需任何用户交互即可触发。该问题已在版本 11.4.9、12.6.1 和 3.1.0 中修复。

CVSS 7.2 · High Updated Oct 29, 2026

Possible ATT&CK Techniques 2 AI

T1059 · Command and Scripting Interpreter T1190 · Exploit Public-Facing Application

Affected Version Matrix 3

Vendor	Product	Version Range	Status
highcharts	highcharts	`>= 6.1.0, < 11.4.9`	affected
		`>= 12.0.0, < 12.6.1`	affected
		`>= 13.0.0, < 13.1.0`	affected

Get alerts for future matching vulnerabilities Log in to subscribe

Vulnerability Information

Have questions about the vulnerability? See if Shenlong's analysis helps!

View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title

Highcharts: dotted series.keys paths write to Object.prototype

Source: CVE Program / CVE List V5

Vulnerability Description

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.

Source: CVE Program / CVE List V5

CVSS Information

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L

Source: CVE Program / CVE List V5

Vulnerability Type

CWE-1321

Source: CVE Program / CVE List V5

Affected Products

Vendor	Product	Affected Versions	CPE	Subscribe
highcharts	highcharts	>= 6.1.0, < 11.4.9	-

II. Public POCs for CVE-2026-118250

#	POC Description	Source Link	Shenlong Link

AI-Generated POC Premium

No public POC found.

III. Intelligence Information for CVE-2026-118250

请登录查看更多情报信息。

Patches & Fixes for CVE-2026-118250 (2)

Vendor Advisories for CVE-2026-118250 (1)

🔗 Core: dotted series.keys paths write to Object.prototype · Advisory · highcharts/highcharts · GitHub Read full article x_refsource_CONFIRM

Vendor Pages for CVE-2026-118250 (1)

🔗 Release v13.1.0 · highcharts/highcharts · GitHub x_refsource_MISC

https://www.cve.org/CVERecord?id=CVE-2026-118250

Same Patch Batch · highcharts · 2026-10-28 · 16 CVEs total

CVE-2026-118245	8.6 HIGH	Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts names
CVE-2026-118254	8.6 HIGH	Highcharts Grid: pagination language options are parsed as HTML
CVE-2026-116797	8.5 HIGH	Highcharts Grid Pro: cell-renderer `attributes` map written with raw `setAttribute`
CVE-2026-118242	8.5 HIGH	Highcharts Grid: custom icon definition objects written with raw `setAttribute` on `<path>
CVE-2026-118246	8.4 HIGH	Highcharts Core: `breadcrumbs.style` keys become SVG event-handler attributes
CVE-2026-118253	8.4 HIGH	Highcharts Dashboards: fullscreen labels are parsed as HTML
CVE-2026-118251	8.4 HIGH	Highcharts: javascript: URL in credits.href runs script on click
CVE-2026-118252	8.4 HIGH	Highcharts Dashboards: sidebar component labels are parsed as HTML
CVE-2026-118255	8.4 HIGH	Highcharts Grid: javascript: URL in credits.href runs script on click
CVE-2026-116796	7.2 HIGH	Highcharts Core: `javascript:` URL in an `xlink:href` attribute survives text filtering an
CVE-2026-118244	7.2 HIGH	Highcharts Core: AST `DOMParser` fallback assigns unsanitized markup to `innerHTML` during
CVE-2026-118249	7.2 HIGH	Highcharts: series column construction writes to Object.prototype
CVE-2026-118247	6.9 MEDIUM	Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__`
CVE-2026-118248	6.9 MEDIUM	Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype
CVE-2026-118243	5.3 MEDIUM	Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototyp

IV. Related Vulnerabilities

Same product: highcharts

Same vendor: highcharts

Same weakness: CWE-1321