## Highcharts: dotted series.keys paths write to Object.prototype

- 種別: advisory
- 重大度: high
- 関連技術: nodejs
- CVE: CVE-2026-118250
- 公開日時: 2026-10-28T19:56:18.000Z
- 情報源: GitHub Advisory Database (https://github.com/advisories/GHSA-rmqc-xvr3-v46c)
- パーマリンク: https://vulnpulse.app/items/ghsa-ghsa-rmqc-xvr3-v46c

影響: npm:highcharts >= 12.0.0, < 12.6.1 → 12.6.1, npm:highcharts >= 13.0.0, <= 13.0.2 → 13.1.0, npm:highcharts >= 6.1.0, < 11.4.9 → 11.4.9
A dot-separated key path taken from series.keys is followed without filtering the individual segments. An attacker who controls series.keys and the matching point data can use a path such as __proto__.polluted to set arbitrary properties on Object.prototype. The resulting properties are visible to all JavaScript running in the page, not only to the chart. No user interaction is required beyond rendering the chart. The injected properties are inert until other code on the page reads them, so con…