Description
The Highcharts component uses the value of chartConstructor to select a function from the Highcharts namespace and invokes it with the component’s container element and its chartOptions, without checking the value against the supported chart constructors.
Recommendation
Update the @highcharts/dashboards package to the latest compatible version. Followings are version details:
- Affected version(s): >= 1.0.0, <= 4.2.1
- Patched version(s): 4.2.2
References
Could your website be exposed too?
SmartScanner can check your website for Highcharts Dashboards: `chartConstructor` is an unchecked lookup into the Highcharts namespace and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Highcharts Grid: `javascript:` URL in credits.href runs script on click - @highcharts/dashboards - CVE-2026-118255
- Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. - @highcharts/dashboards - CVE-2026-118247
- Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` - CVE-2026-118243
- Highcharts Dashboards parses fullscreen labels as HTML - CVE-2026-118253
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026