Zero Radar
← feed
HighVulnerabilityCVE-2026-118250updated 28 Oct 2026, 19:56 UTC

Highcharts charting library can let attackers tamper with all page scripts

A chart library bug lets specially crafted chart data change a shared JavaScript setting that every script on the web page reads. Attackers could use that to alter how the page behaves for everyone viewing it.

Fix availableOfficial, 2 sources
SeverityHighCVSS 7.2 of 10
Being exploited?UnclearNo reports either way yet
Fix available?Yes11.4.9, 12.6.1, 13.1.0 (and 3.1.0 per NVD); a drop-in workaround exists for affected versions · since 28 Oct 2026
How sure is this?Official, 2 sourcesBacked by an official source

How the attack works simplified

  1. 1Crafted chart dataAttacker controls series.keys and point data
  2. 2Chart rendersHighcharts follows the __proto__ path unfiltered
  3. 3Prototype pollutedProperties written onto Object.prototype
  4. 4Page scripts read itInjected values are seen by all page code
  5. ResultPage-wide JavaScript behavior is altered

What happened

Highcharts follows dot-separated 'series.keys' paths without filtering segments, so a path such as __proto__.polluted can write arbitrary properties onto Object.prototype (prototype pollution). This affects npm package highcharts in several version ranges.

Why it is dangerous: Injected properties are visible to all JavaScript on the page, not just the chart, so the impact depends on what the host application does with them; no user interaction is needed beyond rendering the chart. Sites that render attacker-influenced chart data are at risk.

Are you affected?

You are affected if you use the npm package highcharts at versions 6.1.0 up to 11.4.9, 12.0.0 up to 12.6.1, or 13.0.0 up to 13.0.2, and render chart series keys or data that an attacker can control.

Package / productAffected versionsFixed in
highcharts · npm>= 12.0.0, < 12.6.112.6.1
highcharts · npm>= 13.0.0, <= 13.0.213.1.0
highcharts · npm>= 6.1.0, < 11.4.911.4.9

What to do

  1. Upgrade highcharts to 11.4.9, 12.6.1, or 13.1.0 (for example, npm install highcharts@13.1.1)
  2. If you cannot upgrade yet, add the vendor's workaround script that overrides setNestedProperty after Highcharts loads
  3. Make sure chart series keys and data from untrusted sources are validated

Timeline

  1. 28 Oct 2026, 18:17 UTC
    Publicly disclosed
  2. 28 Oct 2026, 18:17 UTC
    Reported by NVD · NVD
  3. 28 Oct 2026, 18:17 UTC
    Picked up by Zero Radar
  4. 28 Oct 2026, 19:56 UTC
    GitHub Advisory reported on it · GitHub Advisory
  5. 28 Oct 2026, 19:56 UTC
    Fixed version published: highcharts 12.6.1, highcharts 13.1.0, highcharts 11.4.9 · GitHub Advisory

Sources 2 reports, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-118250 · GHSA-rmqc-xvr3-v46c
CVSS
7.2 / 10
Disclosed
28 Oct 2026, 18:17 UTC
On Zero Radar
28 Oct 2026, 18:17 UTC (1 min after disclosure)
Last change
28 Oct 2026, 19:56 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

Highcharts charting library can let attackers tamper with all page scripts · Zero Radar