Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. - @highcharts/dashboards

Description

When a single cell value is written to a data table, the column id is used as a key on the table’s column collection without filtering, so a column id of __proto__ resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.prototype; a column id of constructor writes onto the Object constructor in the same way.

Recommendation

Update the @highcharts/dashboards package to the latest compatible version. Followings are version details:

• Affected version(s): >= 1.0.0, <= 4.2.1
• Patched version(s): 4.2.2

References

• GHSA-c75x-9x9h-28rm
• CVE-2026-118247
• CWE-1321
• CAPEC-310