{"id":"CVE-2026-118249","summary":"Highcharts: series column construction writes to Object.prototype","details":"Highcharts JS is a JavaScript charting library based on SVG. From 13.0.0 until 13.1.0, Highcharts builds series data columns by using point option keys directly as column IDs. Own enumerable __proto__ and constructor keys from parsed point objects can therefore direct integer-indexed writes to Object.prototype or the Object constructor. The inherited values affect reads and for-in enumeration across the page and can disrupt rendering or alter consuming application behavior without user interaction beyond rendering the chart. This issue is fixed in 13.1.0.","aliases":["GHSA-gfvx-2c2g-38wq"],"modified":"2026-10-29T02:48:31.522825085Z","published":"2026-10-28T17:57:18.323Z","database_specific":{"cna_assigner":"GitHub_M","cwe_ids":["CWE-1321"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118249.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/118xxx/CVE-2026-118249.json"},{"type":"FIX","url":"https://github.com/highcharts/highcharts/commit/d3357705c8f348904441327e32f50ab528c3a205"},{"type":"FIX","url":"https://github.com/highcharts/highcharts/pull/25321"},{"type":"WEB","url":"https://github.com/highcharts/highcharts/releases/tag/v13.1.0"},{"type":"ADVISORY","url":"https://github.com/highcharts/highcharts/security/advisories/GHSA-gfvx-2c2g-38wq"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118249"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/highcharts/highcharts","events":[{"introduced":"e44b0e19db9affdb85b667524365d268c314b957"},{"fixed":"5d3e905ce2e2c75c174c06cf8dee0f00a5e02841"},{"fixed":"d3357705c8f348904441327e32f50ab528c3a205"}],"database_specific":{"extracted_events":[{"source":"AFFECTED_FIELD","strategy":"StringRangeExpression","range":[{"introduced":"13.0.0"},{"fixed":"13.1.0"}]},{"source":"REFERENCES_COMMIT","range":[{"fixed":"d3357705c8f348904441327e32f50ab528c3a205"}]},{"original_tag":"v13.1.0","range":[{"fixed":"5d3e905ce2e2c75c174c06cf8dee0f00a5e02841"}],"source":"REFERENCES_TAG"}]}}],"versions":["v13.0.0","dashboards-v4.2.2","grid-v3.2.0","v13.0.2","v13.0.1","dashboards-v4.2.1","grid-v3.1.0"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-118249.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V4","score":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:H/VA:H/SC:L/SI:L/SA:L"}]}