Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

影響: npm:@highcharts/dashboards >= 1.0.0, <= 4.2.1 → 4.2.2, npm:@highcharts/grid-pro >= 2.0.0, <= 3.1.0 → 3.2.0

When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of __proto__ resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.prototype; a column id of constructor writes onto the Object constructor in the same way. In Dashboards releases that still supported column aliases, the id is first resolved through the alias map, so a literal __proto__ id i…

在 GitHub Advisory Database 阅读

2026/10/29 04:55，GitHub Advisory Database 发布了“Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.”（类型：漏洞公告）。严重程度为“中危”（medium）。相关技术：JavaScript / Node.js。CVE：CVE-2026-118247。