Highcharts: series column construction writes to Object.prototype

影響: npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0

When series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches Object.prototype and the Object constructor. Keys named __proto__ and constructor survive JSON.parse as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on Object.prototype, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys s…

在 GitHub Advisory Database 阅读

2026/10/29 04:56，GitHub Advisory Database 发布了“Highcharts: series column construction writes to Object.prototype”（类型：漏洞公告）。严重程度为“高危”（high）。相关技术：JavaScript / Node.js。CVE：CVE-2026-118249。