Highcharts: series column construction writes to Object.prototype

影響: npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0

When series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches Object.prototype and the Object constructor. Keys named __proto__ and constructor survive JSON.parse as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on Object.prototype, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys s…

GitHub Advisory Databaseで読む

2026/10/29 04:56、GitHub Advisory Databaseが「Highcharts: series column construction writes to Object.prototype」を公開しました (種別: 脆弱性アドバイザリ)。重大度は「重要」(high) です。関連する技術: JavaScript / Node.js。CVE: CVE-2026-118249。