## Highcharts: series column construction writes to Object.prototype

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-118249
- 公開日時: 2026-10-28T19:56:13.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-gfvx-2c2g-38wq)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-gfvx-2c2g-38wq

影響: npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0
When series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches Object.prototype and the Object constructor. Keys named __proto__ and constructor survive JSON.parse as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on Object.prototype, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys s…