## Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

- 種別: advisory
- 重大度: medium
- 関連技術: nodejs
- CVE: CVE-2026-118247
- 公開日時: 2026-10-28T19:55:37.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-c75x-9x9h-28rm)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-c75x-9x9h-28rm

影響: npm:@highcharts/dashboards >= 1.0.0, <= 4.2.1 → 4.2.2, npm:@highcharts/grid-pro >= 2.0.0, <= 3.1.0 → 3.2.0
When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of __proto__ resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.prototype; a column id of constructor writes onto the Object constructor in the same way. In Dashboards releases that still supported column aliases, the id is first resolved through the alias map, so a literal __proto__ id i…