Highcharts Dashboards EUVD-2026-112302

Exploitation requires three concrete conditions, all satisfiable through the same untrusted configuration: (1) attacker-controlled input must reach the Highcharts Dashboards configuration - specifically a dataPool connector whose DataTable id is set to '__proto__' (or 'constructor'); (2) a component sync that keeps lasting states, such as 'highlight' or 'extremes', must be enabled on a component using that table; and (3) the sync 'group' option can append an attacker-chosen suffix to the fixed state-prefix property name. Limiting factors that reduce real-world risk: the application must trust and pass untrusted data into the board configuration (not a default/standalone deployment behavior), the vector carries PR:L so some privilege/config control is required, affected versions are 1.0.0 through 4.2.1 only, and the injected property is inert until other page code reads or enumerates it - so downstream impact depends on the consuming application rather than being automatic.

Signals are consistent and point to a genuine but low-to-moderate priority. The provided CVSS 4.0 base score is 5.3 (medium) with AV:N/AC:L/AT:N/PR:L/UI:N and only Low integrity/availability impact, no confidentiality impact. The vendor priority Decision label is 'this_month' - not act_now or emergency - which matches a standard-cycle patch rather than an urgent one. No EPSS score and no KEV status were provided in the input, so there is no evidence of active exploitation; this is not a confirmed in-the-wild issue. A public PoC reference exists (a jsfiddle live demo/testing link in the advisory) but it is not verified as working exploit code and primarily demonstrates the pollution and workaround. The decisive limiter is the precondition: exploitation requires attacker-controlled dashboard configuration to reach Highcharts Dashboards (a malicious dataPool connector table id of __proto__) plus an enabled component sync - this is a configuration-trust/design flaw, not remote-unauthenticated exploitation of a default deployment, consistent with PR:L in the vector. Real-world impact is modest: it writes one enumerable property onto Object.prototype and can throw and break lasting sync states such as extremes (a self-DoS of charting features); any further consequence is inert until other page code enumerates the property, so it depends on the consuming application. Net: real and worth patching on a normal cycle, not a high-urgency emergency despite the 'prototype pollution' label.

An attacker who can influence the Highcharts Dashboards configuration - for example an application that feeds untrusted data into dashboard/dataPool config - supplies a connector with a DataTable id of '__proto__'. When a component with an enabled sync such as 'highlight' or 'extremes' loads the board, sync registration resolves that id to Object.prototype and creates an enumerable listener-array property there, visible on every object and breaking lasting sync states. A public PoC/demo reference (jsfiddle) exists but is not verified as working exploit code; no user interaction is required beyond loading the board (CVSS AV:N/AC:L/UI:N, but PR:L requires control over the configuration).