Highcharts JS EUVD-2026-112363

Exploitation requires that the application feed attacker-controlled point data into a Highcharts series (e.g. a column series via setData or the data option) on versions 13.0.0-13.0.2, and that the data was produced by JSON.parse - this is essential because '__proto__' and 'constructor' survive JSON.parse as own enumerable keys, whereas in an object literal they would change the prototype instead and not trigger the flaw. No user interaction is needed beyond rendering the chart. Limiting factors that reduce realistic risk: the attacker must control the chart's data source (not inherent in Highcharts itself); only integer-indexed properties can be set this way (named properties cannot be reached); and the severity of any consequence beyond disrupted rendering and polluted for-in enumeration depends entirely on whether the consuming application's own code trusts prototype-inherited or out-of-range values.

This is a genuine but context-dependent client-side prototype pollution flaw (CWE-1321), not a drop-everything emergency. The input CVSS 4.0 vector scores it 7.2 (high) with AV:N/AC:L/AT:N/PR:L/UI:N and vulnerable-system VI:H/VA:H, VC:L - i.e. the severity is driven by integrity and availability of the rendering context, with only low confidentiality impact. No EPSS score and no CISA KEV status were provided, so there is no signal of widespread or active exploitation; vuln.today assigns a 'this_week' priority (not act_now/emergency), which matches a serious-but-not-critical posture. A public PoC reference exists (the vendor's jsfiddle live demo plus QUnit regression tests committed in the fix PR), but the input does not confirm it as a weaponized, working exploit, so this should be treated as 'a public PoC reference exists; it is not verified as working exploit code,' distinct from active exploitation. A key nuance: the given vector uses PR:L, but the real gate is not authentication to Highcharts - it is whether the application feeds attacker-controlled point data into the chart; in deployments that plot untrusted user- or API-supplied JSON, no privileges are effectively required. The impact ceiling is also application-dependent: the advisory explicitly says 'consequences beyond disruption depend on the consuming application,' so the baseline guaranteed effect is page-wide prototype pollution causing disrupted rendering or altered branching, with escalation possible only where downstream code trusts the polluted values. Note also an affected-range inconsistency across sources (see confidence_notes) that should be verified before scoping.

An attacker who can influence the data a web application plots - for example a user-submitted dataset or an upstream API feeding chart series - crafts JSON containing '__proto__' or 'constructor' keys. When the app parses it with JSON.parse (which preserves those keys as own enumerable properties) and renders it in a Highcharts column series on versions 13.0.0-13.0.2, the write that builds the data columns lands integer-indexed properties on Object.prototype and the Object constructor, polluting every object on the page with no user interaction beyond rendering the chart. A public PoC reference exists (vendor jsfiddle demo and QUnit tests in the fix PR); it is not verified as working weaponized exploit code.