Highcharts Dashboards EUVD-2026-112362

Exploitation requires the attacker to control a Dashboards component's editableOptions[].propertyPath - realistic only when board configuration passed to Dashboards.board() originates from an untrusted source such as an API, CMS, or user-generated content - with the path containing __proto__, constructor, or prototype segments. The malicious write does not fire automatically: a legitimate user must open the affected component in edit mode and edit the configured option (CVSS UI:A), so required user interaction is a genuine limiting factor. Affected versions are @highcharts/dashboards >= 1.0.0 and <= 4.2.1; 4.2.2 is fixed. A further limiter is that the injected Object.prototype property is inert until other code on the page reads it, so impact depends entirely on the consuming application. The vendor-supplied workaround (filtering unsafe propertyPath keys before passing config to Dashboards.board(), or patching updateOptions) mitigates on unpatched versions, but the advisory notes updating is the complete fix.

This is a moderate-severity, precondition-gated prototype pollution flaw (CWE-1321) rather than a drop-everything emergency. The vendor CVSS 4.0 score is 6.9 (medium) with vector AV:N/AC:L/AT:N/PR:L/UI:A, meaning network reachable and low complexity but requiring low-level privileges AND active user interaction. The vuln.today decision label is 'this_month', signaling it belongs in the normal monthly patch cycle, not an act_now/emergency track. No EPSS score and no CISA KEV entry were supplied, and no public exploit code is referenced - only the vendor GHSA advisory and the fix commit. The practical risk is bounded by two real preconditions that the raw CVSS does not fully convey: the attacker must control a component's editableOptions[].propertyPath (realistic only when board configuration is sourced from an untrusted API, CMS, or user-generated content), and a legitimate user must actually edit that option in Dashboards edit mode to trigger the write (UI:A). The direct technical impact is an integrity write onto Object.prototype (VI:H); confidentiality impact is rated N and the ultimate consequence 'is determined by the consuming application,' so any availability or disclosure outcome is contingent, not guaranteed. Net: a legitimate issue worth patching this month, but the attacker-control-of-config plus required user interaction keep it well below the urgency of an unauthenticated, no-interaction RCE.

An application renders a Highcharts Dashboards board whose component configuration is partly sourced from untrusted input (an API, CMS, or user-generated content); the attacker submits a component whose editableOptions entry has a propertyPath containing __proto__ or constructor. When a legitimate user later opens that component in edit mode and changes the option, the walk applies the value onto Object.prototype, polluting it for all page JavaScript. No public exploit code is referenced - only the vendor advisory and patch commit - and the effect stays inert until other code on the page reads the injected property.