Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

影響: npm:@highcharts/dashboards >= 1.0.0, <= 4.2.1 → 4.2.2, npm:@highcharts/grid-pro >= 2.0.0, <= 3.1.0 → 3.2.0

When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of __proto__ resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.prototype; a column id of constructor writes onto the Object constructor in the same way. In Dashboards releases that still supported column aliases, the id is first resolved through the alias map, so a literal __proto__ id i…

Read on GitHub Advisory Database

On 10/29/2026, 04:55 AM, GitHub Advisory Database published "Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column." (type: Advisory). Severity is "Medium" (medium). Related technologies: JavaScript / Node.js. CVE: CVE-2026-118247.