Highcharts: series column construction writes to Object.prototype

影響: npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0

When series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches Object.prototype and the Object constructor. Keys named __proto__ and constructor survive JSON.parse as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on Object.prototype, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys s…

Read on GitHub Advisory Database

On 10/29/2026, 04:56 AM, GitHub Advisory Database published "Highcharts: series column construction writes to Object.prototype" (type: Advisory). Severity is "High" (high). Related technologies: JavaScript / Node.js. CVE: CVE-2026-118249.