Zero Radar
← feed
HighVulnerabilityCVE-2026-118249updated 28 Oct 2026, 19:56 UTC

Highcharts charting library can be abused to tamper with page-wide JavaScript objects

A crafted chart data file can slip special property names into the page's shared JavaScript objects, which can break how the page draws charts or make other scripts behave wrongly. No clicks are needed beyond viewing the chart.

Fixed in 13.1.0Official, 2 sources
SeverityHighCVSS 7.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes13.1.0 · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Crafted chart dataPoint objects contain __proto__ or constructor keys
  2. 2JSON parsedKeys survive as own enumerable properties
  3. 3Highcharts builds columnsPoint keys used directly as column IDs
  4. 4Prototype pollutedInteger-indexed values written to Object.prototype
  5. ResultPage-wide objects are tampered with

What happened

Highcharts 13.0.0 through 13.0.2 use point option keys directly as data column IDs, so attacker-controlled keys named __proto__ or constructor can write integer-indexed values onto Object.prototype and the Object constructor (prototype pollution).

Why it is dangerous: The injected values persist and affect every object on the page, causing rendering failures and possibly altering consuming application logic; anyone who renders charts from untrusted or externally supplied point data is at risk.

Are you affected?

You are affected if you use the highcharts npm package or CDN build version 13.0.0 through 13.0.2 (6.1.0-13.0.2 per the workaround note) and render charts from point data that can be influenced by an outside party.

Package / productAffected versionsFixed in
highcharts · npm>= 13.0.0, <= 13.0.213.1.0

What to do

  1. Update highcharts to version 13.1.0 or later (npm install highcharts@13.1.0, or load https://code.highcharts.com/13.1.0/highcharts.js).
  2. If you cannot update yet, add the vendor-provided workaround script that patches Point.optionsToObject and Point.setNestedProperty to run right after Highcharts loads.
  3. Review whether your charts are built from untrusted point data and restrict that input until patched.

Timeline

  1. 28 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 18:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 19:56 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 19:56 UTC
    Fixed version published: highcharts 13.1.0 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118249 · GHSA-gfvx-2c2g-38wq
CVSS
7.2 / 10
Disclosed
28 Oct 2026, 18:17 UTC
On Zero Radar
28 Oct 2026, 18:17 UTC (1 min after disclosure)
Last change
28 Oct 2026, 19:56 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Highcharts charting library can be abused to tamper with page-wide JavaScript objects · Zero Radar