CVE-2026-118249

The Highcharts JS charting library (versions 13.0.0 to 13.1.0 ) is vulnerable to Prototype Pollution (CWE-1321). The flaw occurs because the library builds series data columns using point option keys directly as column IDs. This allows own enumerable — specifically —proto— and constructor keys fr...

CVE-2026-118249 Highcharts: series column construction writes to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable proto and constructor keys from parsed point objects can therefore direct integer-indexed writes to...