CVE-2026-118250

What it actually does

Unfiltered dot-separated paths in series.keys permit traversal through __proto__ to assign attacker-controlled properties directly to Object.prototype, making them visible across all JavaScript objects in the page context with no user interaction required beyond chart rendering.

Why it matters to the business

Web applications embedding charts may experience silent global object pollution that alters application logic, enables further client-side attacks, or causes unexpected data handling behavior for all users viewing affected charts.

How an attack unfolds

An attacker supplies a malicious series.keys array containing a __proto__ path and corresponding point data; when the chart renders, Highcharts walks the path without segment validation and sets arbitrary properties on Object.prototype, affecting every subsequent object operation in the page.

How to fix it

Upgrade Highcharts to version 11.4.9, 12.6.1, or 3.1.0 or later; if immediate upgrade is not possible, disable or sanitize series.keys input before passing it to the chart constructor.

How to confirm the fix worked

Confirm the installed Highcharts version meets or exceeds 11.4.9, 12.6.1, or 3.1.0; test rendering with a series.keys value containing __proto__ and verify that no properties are added to Object.prototype.

Typical attack path

1. Identify a page that renders a Highcharts chart with attacker-controlled series configuration or data
2. Craft series.keys containing a dot path that includes __proto__ and matching point values to set desired prototype properties
3. Deliver the malicious chart configuration to the victim (via stored data, API response, or direct input)
4. Victim loads the page and the chart renders, executing the prototype assignment with no further interaction
5. Attacker observes or triggers downstream effects from the polluted Object.prototype

How to detect it

Review application logs or browser telemetry for chart rendering events that include series.keys containing the literal string __proto__; inspect client-side network responses or stored data feeds that populate chart series for suspicious dot-path values.

What your security team should do

• Prioritize upgrade of all Highcharts instances to a fixed release within the next 7 days given the public disclosure and ease of exploitation
• Audit applications for any dynamic construction of series configuration from untrusted sources
• Implement input sanitization on series.keys arrays as a defense-in-depth measure even after patching