CVE-2026-118248 Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through proto or constructor, and ...

CVE-2026-118248

The Highcharts JS charting library (versions 1.0.0 through 4.2.2 ) is vulnerable to Prototype Pollution via the Dashboards edit mode. The root cause is that the library fails to reject prototype-related keys while walking editableOptions property paths. An attacker controlling editableOptions can...