CVE-2026-118250 Highcharts: dotted series.keys paths write to Object.prototype
- Exploited in the wild
- Not known
- Fix
- Available
What is CVE-2026-118250?
CVE-2026-118250 is a high-severity vulnerability in highcharts, published on 28 Oct 2026.
Official description
Highcharts JS is a JavaScript charting library based on SVG. From 6.1.0 until 11.4.9, 12.6.1, and 3.1.0, Highcharts follows dot-separated series.keys paths without filtering each segment. An attacker who controls series.keys and matching point data can use a path through __proto__ to assign arbitrary named properties to Object.prototype. Those properties are visible to all JavaScript in the page, and no user interaction is required beyond rendering the chart. This issue is fixed in 11.4.9, 12.6.1, and 3.1.0.
Weakness: CWE-1321
Which versions are affected by CVE-2026-118250?
6 open source packages ship an affected version, including highcharts.
| Package | Affected | Fixed in |
|---|---|---|
highcharts npm | From 12.0.0 | 12.6.1 |
highcharts npm | From 12.0.0 | 12.6.1 |
highcharts npm | From 13.0.0 | 13.1.0 |
highcharts npm | From 13.0.0 | 13.1.0 |
highcharts npm | From 6.1.0 | 11.4.9 |
highcharts npm | From 6.1.0 | 11.4.9 |
How do I fix CVE-2026-118250?
Upgrade highcharts to a fixed version for your release line: 12.6.1, 13.1.0 or 11.4.9.
Is CVE-2026-118250 being exploited?
There is no known exploitation of CVE-2026-118250 in the wild and no public exploit code.
Sources
Also known as GHSA-rmqc-xvr3-v46c.