CVE-2026-118247

Name of the Vulnerable Software and Affected Versions Highcharts Dashboards versions prior to 4.2.2 Highcharts Grid Pro versions prior to 3.2.0

Description Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting proto or constructor. This allows an attacker who controls the column ID to write integer-indexed values onto Object.prototype or the Object constructor. This occurs through the DataTable.setCell() function, including Dashboards connector write-back and Grid Pro editing paths. In Dashboards, the write is reached via the component's connector write-back, enabled by allowConnectorUpdate, which takes the column ID from columnAssignment. In Grid Pro, it is reachable through cell editing or the public DataTable API. These inherited values affect array and object reads and for-in enumeration across the page, which can alter application control flow or disrupt rendering.

Recommendations Update Highcharts Dashboards to version 4.2.2. Update Highcharts Grid Pro to version 3.2.0. Strip unsafe keys proto and constructor from untrusted column data before it is passed to a grid, board, or DataTable. Patch the DataTable.prototype.setCell(), DataTable.prototype.changeColumnId(), and DataTable.prototype.setColumns() methods to reject proto and constructor as column IDs.