{"id":"ghsa-ghsa-gfvx-2c2g-38wq","seq":2056977,"kind":"advisory","title":"Highcharts: series column construction writes to Object.prototype","url":"https://github.com/advisories/GHSA-gfvx-2c2g-38wq","permalink":"https://vulnpulse.app/items/ghsa-ghsa-gfvx-2c2g-38wq","summary":"影響: npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0\nWhen series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches Object.prototype and the Object constructor. Keys named __proto__ and constructor survive JSON.parse as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on Object.prototype, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys s…","severity":"high","techs":["nodejs"],"cves":["CVE-2026-118249"],"tags":["GHSA-gfvx-2c2g-38wq","highcharts"],"source":{"id":"ghsa","name":"GitHub Advisory Database"},"published_at":"2026-10-28T19:56:13.000Z","fetched_at":"2026-10-29T00:48:52.653Z"}