Highcharts Dashboards CVE-2026-118247

Exploitation requires the attacker to control a table or component column ID and to cause a cell, point, or API write. In Dashboards the unsafe write is reached by default through the Highcharts component's connector write-back (allowConnectorUpdate is enabled by default), taking the column ID from columnAssignment (or the series name in the earliest releases) when a point is updated; in Grid Pro it is reached through cell editing in earlier releases and remains reachable through the public DataTable API. Untrusted data must therefore reach the board or Grid configuration. In Dashboards releases that still support column aliases, a literal __proto__ ID is redirected harmlessly by the alias map, but an alias whose target is __proto__ (accepted by the connector's data table options) reaches the unsafe write; later alias-free releases accept a literal __proto__ or constructor ID directly. Limiting factors: only integer-keyed (row-index) properties can be set - named properties cannot be reached through these paths; a write action (point update or cell edit) is required; and impact beyond rendering disruption depends on how the consuming application reads polluted objects.

This is a medium-severity client-side prototype pollution issue (CVSS 4.0 base 6.9; CWE-1321). The supplied CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L) describes a network-reachable but privilege- and interaction-dependent flaw: PR:L and UI:A mean the attacker must be able to get untrusted data into a table/component column ID and trigger a write, not a pure remote-unauthenticated hit. Impact skews toward availability (VA:H - rendering disruption/DoS of the page) with only limited integrity impact (VI:L) and explicitly no confidentiality impact (VC:N), consistent with the advisory noting that only integer-keyed properties can be set and named properties cannot be reached. The vuln.today decision label is 'this_month' (not act_now/emergency), a patch is available, and there is no CISA KEV listing and no EPSS score in the input, so there is no evidence of active exploitation. No public exploit code is referenced - only the vendor GHSA advisory and the fix commit. Net: a genuine defect worth patching on a normal cadence rather than an emergency; real-world severity is bounded because exploitation requires attacker-controlled column IDs plus a write path, and consequences beyond disruption depend entirely on how the consuming application reads polluted objects. Missing data to note explicitly: EPSS is absent (cannot gauge exploitation probability) and there is a fixed-version discrepancy across sources (see confidence notes).

An attacker who can influence data that becomes a Highcharts DataTable column ID - for example through a Dashboards connector write-back (enabled by default via allowConnectorUpdate) or Grid Pro cell editing - supplies a column ID of __proto__ or constructor (or, in alias-supporting Dashboards releases, an alias whose target is __proto__) and triggers a point update or cell write. DataTable.setCell then writes an integer-indexed value onto Object.prototype or the Object constructor, polluting every object and array on the page so that out-of-range reads and for...in loops return attacker-supplied values, altering control flow or breaking rendering. No public exploit code is referenced; only the vendor advisory and fix commit are available.