Highcharts: series column construction writes to Object.prototype

影響: npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0

When series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches Object.prototype and the Object constructor. Keys named __proto__ and constructor survive JSON.parse as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on Object.prototype, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys s…

GitHub Advisory Database에서 읽기

2026. 10. 29. 오전 04:56, GitHub Advisory Database에서 "Highcharts: series column construction writes to Object.prototype"을(를) 게시했습니다 (유형: 취약점 권고). 심각도는 "높음"(high)입니다. 관련 기술: JavaScript / Node.js. CVE: CVE-2026-118249.