CVE-2026-118243

Name of the Vulnerable Software and Affected Versions Highcharts Dashboards versions 1.0.0 through 4.2.1

Description Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. If a proto table ID is supplied through the dataPool connector configuration, it resolves to Object.prototype. When a sync registers its listeners, an enumerable property is created on Object.prototype with a name influenced by the group option. This property is visible on every object in the page. Emitting a lasting state for that table ID can cause errors that stop features like extremes synchronization from working. Exploitation occurs when untrusted dashboard configuration is loaded and a component sync, such as highlight or extremes, is enabled, requiring no user interaction beyond loading the board.

Recommendations Update Highcharts Dashboards to version 4.2.2. As a temporary workaround, implement a script to patch the DataCursor and DataTable prototypes to prevent proto pollution by ensuring listener and state maps are created without prototypes and by validating the id property of DataTable to prevent the use of proto or constructor.