CVE-2026-118243
Published:October 28, 2026
Updated:November 03, 2026
Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A proto table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates an enumerable property there whose suffix can be influenced through the sync group option. The property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and an enabled component sync, but no user interaction beyond loading the board. This issue is fixed in 4.2.2.
Affected Packages
https://github.com/highcharts/highcharts.git (GITHUB):
Affected version(s) >=grid-v1.0.0 <grid-v3.2.0 || >=grid-v2.0.0 <grid-v3.2.0 || >=grid-v3.0.0 <grid-v3.2.0Fix Suggestion:
Update to version grid-v3.2.0https://github.com/highcharts/highcharts.git (GITHUB):
Affected version(s) >=v11.0.0 <v13.1.0 || >=v12.0.0 <v13.1.0 || >=v13.0.0-beta.1 <v13.1.0 || >=v13.0.0 <v13.1.0Fix Suggestion:
Update to version v13.1.0https://github.com/highcharts/highcharts.git (GITHUB):
Affected version(s) >=dashboards-v1.0.0 <dashboards-v4.2.2 || >=dashboards-v2.0.0 <dashboards-v4.2.2 || >=dashboards-v3.0.0 <dashboards-v4.2.2 || >=dashboards-v4.0.0 <dashboards-v4.2.2Fix Suggestion:
Update to version dashboards-v4.2.2highcharts (NPM):
Affected version(s) >=11.0.0 <13.1.0 || >=12.0.0 <13.1.0 || >=13.0.0-beta.0 <13.1.0 || >=13.0.0 <13.1.0Fix Suggestion:
Update to version 13.1.0@highcharts/grid-lite (NPM):
Affected version(s) >=1.0.0 <3.2.0 || >=2.0.0 <3.2.0 || >=3.0.0 <3.2.0Fix Suggestion:
Update to version 3.2.0@highcharts/dashboards (NPM):
Affected version(s) >=1.0.0 <4.2.2Fix Suggestion:
Update to version 4.2.2@highcharts/grid-pro (NPM):
Affected version(s) >=2.0.0 <3.2.0 || >=3.0.0 <3.2.0Fix Suggestion:
Update to version 3.2.0@highcharts/dashboards (NPM):
Affected version(s) >=1.0.0 <4.2.2 || >=4.0.0 <4.2.2 || >=3.0.0 <4.2.2 || >=2.0.0 <4.2.2Fix Suggestion:
Update to version 4.2.2Additional Notes
The description of this vulnerability differs from MITRE.
Related Resources (6)
Do you need more information?
Contact UsCVSS v4
Base Score:
5.3
Attack Vector
NETWORK
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
NONE
Vulnerable System Integrity
LOW
Vulnerable System Availability
LOW
Subsequent System Confidentiality
LOW
Subsequent System Integrity
LOW
Subsequent System Availability
LOW
CVSS v3
Base Score:
6.4
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
LOW
User Interaction
NONE
Scope
CHANGED
Confidentiality
NONE
Integrity
LOW
Availability
LOW
Weakness Type (CWE)
Improperly Controlled Modification of Object Prototype Attributes
EPSS
Base Score:
0.35