CVE-2026-118250
High
Description
Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.
SeverityHigh
CVSS7.2
Exploit probability—
Product
Highcharts
PublishedOct 28, 2026
First seenNov 4, 2026
Weakness typeCWE-1321Prototype pollution
How to fix
Update
- highcharts12.6.1, 13.1.0, 11.4.9 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| highchartsnpm | 12.0.0 ≤ v < 12.6.1, 13.0.0 ≤ v ≤ 13.0.2, 6.1.0 ≤ v < 11.4.9 | 12.6.1, 13.1.0, 11.4.9 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.