CVE-2026-118248

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118248", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.313Z", "datePublished": "2026-10-28T17:55:47.520Z", "dateUpdated": "2026-10-30T18:21:14.325Z"}, "containers": {"cna": {"title": "Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:L/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm"}, {"name": "https://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b"}, {"name": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2"}], "affected": [{"vendor": "highcharts", "product": "highcharts", "versions": [{"version": "< 13.1.0", "status": "affected"}]}, {"vendor": "@highcharts", "product": "dashboards", "versions": [{"version": ">= 1.0.0, < 4.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T17:55:47.520Z"}, "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2."}], "source": {"advisory": "GHSA-wg5j-9wp8-2ggm", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-30T18:21:05.324040Z", "id": "CVE-2026-118248", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T18:21:14.325Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-118248", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-10-27T20:13:55.313Z", "datePublished": "2026-10-28T17:55:47.520Z", "dateUpdated": "2026-10-30T18:21:14.325Z"}, "containers": {"cna": {"title": "Highcharts Dashboards: editableOptions.propertyPath writes to Object.prototype", "problemTypes": [{"descriptions": [{"cweId": "CWE-1321", "lang": "en", "description": "CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "LOW", "userInteraction": "ACTIVE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "HIGH", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "subAvailabilityImpact": "LOW", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:L/SI:L/SA:L", "version": "4.0"}}], "references": [{"name": "https://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm"}, {"name": "https://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b"}, {"name": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2", "tags": ["x_refsource_MISC"], "url": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2"}], "affected": [{"vendor": "highcharts", "product": "highcharts", "versions": [{"version": "< 13.1.0", "status": "affected"}]}, {"vendor": "@highcharts", "product": "dashboards", "versions": [{"version": ">= 1.0.0, < 4.2.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-10-28T17:55:47.520Z"}, "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2."}], "source": {"advisory": "GHSA-wg5j-9wp8-2ggm", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-118248", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-30T18:21:05.324040Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-30T18:21:10.824Z"}}]}}

{"affected": [{"affectedData": [{"product": "highcharts", "vendor": "highcharts", "versions": [{"status": "affected", "version": "< 13.1.0"}]}, {"product": "dashboards", "vendor": "@highcharts", "versions": [{"status": "affected", "version": ">= 1.0.0, < 4.2.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2."}], "id": "CVE-2026-118248", "lastModified": "2026-10-30T19:18:18.283", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "ACTIVE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "HIGH", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-118248", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-30T18:21:05.324040Z", "version": "2.0.3"}}]}, "published": "2026-10-28T18:17:15.870", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b"}, {"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2"}, {"source": "security-advisories@github.com", "url": "https://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1321"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{"bugzilla": {"description": "@highcharts/dashboards: Highcharts Dashboards: Prototype pollution via unvalidated property paths", "id": "2564229", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2564229"}, "csaw": false, "cvss3": {"cvss3_base_score": "4.6", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L", "status": "draft"}, "cwe": "CWE-915", "details": ["Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards edit mode walks editableOptions propertyPath segments without rejecting prototype-related keys. An attacker who controls editableOptions can provide a path through __proto__ or constructor, and a user's edit writes the configured value onto Object.prototype. The property then becomes visible to JavaScript throughout the page, with consequences determined by the consuming application. This issue is fixed in 4.2.2.", "A flaw was found in Highcharts Dashboards. The edit mode component fails to properly validate object property paths, allowing prototype-related keys to be processed. An attacker who controls editable configuration options can supply crafted paths to modify base JavaScript object prototypes (prototype pollution). This manipulation alters global application properties, potentially leading to a Denial of Service (DoS) or unexpected behavior across the consuming web application."], "name": "CVE-2026-118248", "public_date": "2026-10-28T17:55:47Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-118248\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-118248\nhttps://github.com/highcharts/highcharts/commit/05efb9849130461fe61992ea8f58d22edaad978b\nhttps://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2\nhttps://github.com/highcharts/highcharts/security/advisories/GHSA-wg5j-9wp8-2ggm"], "statement": "Red Hat Product Security rates the severity of this vulnerability as Moderate because exploitation requires an attacker to control specific configuration options and relies on user interaction within dashboard edit mode. The blast radius is confined to the client-side JavaScript execution environment, preventing direct compromise of host systems or backend infrastructure. Consequently, the impact is primarily limited to potential client-side denial of service or erratic application behavior during an active session.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[1.0.0,4.2.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "dashboards", "source": "cna", "vendor": "@highcharts"}, "product": "dashboards", "vendor": "highcharts"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,13.1.0)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "highcharts", "source": "cna", "vendor": "highcharts"}, "product": "highcharts", "vendor": "highcharts"}], "created": "2026-10-28T19:45:07.051120+00:00", "updated": "2026-11-06T03:15:14.584741+00:00", "vendors": ["highcharts", "highcharts$PRODUCT$dashboards", "highcharts$PRODUCT$highcharts"]}