Description
A dot-separated key path taken from series.keys is followed without filtering the individual segments. An attacker who controls series.keys and the matching point data can use a path such as __proto__.polluted to set arbitrary properties on Object.prototype.
Recommendation
Update the highcharts package to the latest compatible version. Followings are version details:
Affected version(s): **>= 6.1.0, < 11.4.9 >= 13.0.0, <= 13.0.2 >= 12.0.0, < 12.6.1** Patched version(s): **11.4.9 13.1.0 12.6.1**
References
Could your website be exposed too?
SmartScanner can check your website for Highcharts: dotted series.keys paths write to Object.prototype and gives you actionable findings to investigate.
Start a free scanRelated Issues
- Highcharts: series column construction writes to Object.prototype - CVE-2026-118249
- Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` - CVE-2026-118243
- Axios: Prototype-Pollution Gadget in the Default Instance Allows Inherited Object.prototype.method to Override HTTP Meth - CVE-2026-101902
- protobufjs: Text Format string map parsing can mutate returned map object prototype - CVE-2026-59876
You might also like:
See something that needs correcting? Let us knowUpdated October 28, 2026