GHSA-RMQC-XVR3-V46C Highcharts: dotted series.keys paths write to Object.prototype

Impact A dot-separated key path taken from series.keys is followed without filtering the individual segments. An attacker who controls series.keys and the matching point data can use a path such as proto.polluted to set arbitrary properties on Object.prototype. The resulting properties are visibl...

npm: Highcharts: dotted series.keys paths write to Object.prototype

npm: Highcharts: dotted series.keys paths write to Object.prototype vulnerability discovered by ? in WordPress npm highcharts versions = 6.1.0, 11.4.9...

Highcharts: dotted series.keys paths write to Object.prototype

Impact A dot-separated key path taken from series.keys is followed without filtering the individual segments. An attacker who controls series.keys and the matching point data can use a path such as proto.polluted to set arbitrary properties on Object.prototype. The resulting properties are visibl...

CVE-2026-118250

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through proto to assign arbitrary...

CVE-2026-118250

The Highcharts JS charting library (versions 6.1.0 through 11.4.9 , 12.6.1 , and 3.1.0 ) is vulnerable to Prototype Pollution (CWE-1321). The root cause is that the library processes dot-separated series.keys paths without filtering each segment. An attacker who can control series.keys and corres...

CVE-2026-118250 Highcharts: dotted series.keys paths write to Object.prototype

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through proto to assign arbitrary...

EUVD-2026-112364

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through proto to assign arbitrary...

PT-2026-129097

Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through proto to assign arbitrary...

Vaadin input validation error vulnerability

Security vulnerabilities exist in Vaadin Charts versions 22.0.0 through 23.6.15, 24.0.0 through 24.4.23, 24.5.0 through 24.7.15, 24.8.0 through 24.9.22, 24.10.0 through 24.10.10, 25.0.0 through 25.2.9, and 25.3.0. These vulnerabilities stem from improper handling of chart configurations within th...