Quick answers
- Is CVE-2026-118243 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-118243 being exploited in the wild.
- How severe is CVE-2026-118243?
- Medium severity, with a CVSS score of 4, published 28 October 2026.
- Which products and versions are affected?
- Highcharts Dashboards 1.0.0 to 4.2.1; @highcharts/dashboards (npm) >= 1.0.0, <= 4.2.1, SEMVER:introduced=1.0.0,fixed=4.2.2.
- Is there a fix for CVE-2026-118243?
- Yes. @highcharts/dashboards (npm): upgrade to 4.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-118243 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-118243?
- Check whether you run Highcharts Dashboards or @highcharts/dashboards (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- @highcharts/dashboards (npm): upgrade to 4.2.2 or later
npm install @highcharts/dashboards@4.2.2
Technical details
The vulnerability is a prototype pollution flaw in Highcharts Dashboards versions 1.0.0 through 4.2.2 where DataCursor listener and state maps use plain objects keyed by DataTable ID without protection against the __proto__ key. An attacker can supply __proto__ as a table ID via the dataPool connector configuration, causing sync registration to write enumerable properties to Object.prototype. This pollutes all objects in the application and can cause features like extremes synchronization to fail. The attack requires untrusted dashboard configuration and enabled component sync but no user interaction.
Affected products
- Highcharts Dashboards 1.0.0 to 4.2.1
Identifiers
- CVE-2026-118243
- GHSA-jqgh-w3cc-7jqw
Timeline
- 2026-10-28: disclosed