Highcharts: series column construction writes to Object.prototype

Description

When series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches Object.prototype and the Object constructor. Keys named __proto__ and constructor survive JSON.parse as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on Object.prototype, one per point index, to values of their choosing.

Recommendation

Update the highcharts package to the latest compatible version. Followings are version details:

• Affected version(s): >= 13.0.0, <= 13.0.2
• Patched version(s): 13.1.0

References

• GHSA-gfvx-2c2g-38wq
• CVE-2026-118249
• CWE-1321
• CAPEC-310