# CVE-2026-118243: Highcharts Dashboards prototype pollution via table IDs

Source: https://junglewise.ai/threats/cve-2026-118243-highcharts-js-is-a-javascript-charting-library-based-on-svg-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118243 · Severity: medium · CVSS 4 · Published 2026-10-28

Highcharts Dashboards is a JavaScript library used to display interactive data visualizations and dashboards in web applications. An attacker who provides a malicious dashboard configuration can exploit a prototype pollution vulnerability to inject properties into core JavaScript objects, potentially breaking dashboard features like data synchronization or enabling more advanced attacks. This requires loading an untrusted dashboard configuration but no user interaction beyond viewing the page.

Technologies: [Highcharts Dashboards](https://junglewise.ai/threats/technologies/dashboards), [@highcharts/dashboards (npm)](https://junglewise.ai/threats/technologies/highcharts-dashboards). Vendors: [Highcharts](https://junglewise.ai/threats/vendors/highcharts), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-118243 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118243 being exploited in the wild.

**How severe is CVE-2026-118243?** Medium severity, with a CVSS score of 4, published 28 October 2026.

**Which products and versions are affected?** Highcharts Dashboards 1.0.0 to 4.2.1; @highcharts/dashboards (npm) >= 1.0.0, <= 4.2.1, SEMVER:introduced=1.0.0,fixed=4.2.2.

**Is there a fix for CVE-2026-118243?** Yes. @highcharts/dashboards (npm): upgrade to 4.2.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118243 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118243?** Check whether you run Highcharts Dashboards or @highcharts/dashboards (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- @highcharts/dashboards (npm): upgrade to 4.2.2 or later

  ```sh
  npm install @highcharts/dashboards@4.2.2
  ```


## Technical details

The vulnerability is a prototype pollution flaw in Highcharts Dashboards versions 1.0.0 through 4.2.2 where DataCursor listener and state maps use plain objects keyed by DataTable ID without protection against the __proto__ key. An attacker can supply __proto__ as a table ID via the dataPool connector configuration, causing sync registration to write enumerable properties to Object.prototype. This pollutes all objects in the application and can cause features like extremes synchronization to fail. The attack requires untrusted dashboard configuration and enabled component sync but no user interaction.

## Affected products

- Highcharts Dashboards 1.0.0 to 4.2.1

## Identifiers

- CVE-2026-118243
- GHSA-jqgh-w3cc-7jqw

## Timeline

- 2026-10-28: disclosed

## References

- [https://github.com/highcharts/highcharts/commit/ade5a41a700212f09133223ca990a3737d1d9ec6](https://github.com/highcharts/highcharts/commit/ade5a41a700212f09133223ca990a3737d1d9ec6)
- [https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2](https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2)

## Related threats

- [Highcharts Grid unvalidated credits href XSS](https://junglewise.ai/threats/cve-2026-118255-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Dashboards cross-site scripting in fullscreen label](https://junglewise.ai/threats/cve-2026-118253-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Dashboards XSS in edit-mode sidebar](https://junglewise.ai/threats/cve-2026-118252-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts Dashboards prototype pollution in edit mode](https://junglewise.ai/threats/cve-2026-118248-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts DataTable prototype pollution via column ID](https://junglewise.ai/threats/cve-2026-118247-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)