Is CVE-2026-118247 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118247 being exploited in the wild.

How severe is CVE-2026-118247?

Medium severity, with a CVSS score of 4, published 28 October 2026.

Which products and versions are affected?

Highcharts Dashboards 1.0.0 to 4.2.1; Highcharts Grid Pro 2.0.0 to 3.1.x; @highcharts/dashboards (npm) >= 1.0.0, = 2.0.0, <= 3.1.0, SEMVER:introduced=2.0.0,fixed=3.2.0.

Is there a fix for CVE-2026-118247?

Yes. @highcharts/dashboards (npm): upgrade to 4.2.2 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118247 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118247?

Check whether you run Highcharts Dashboards, Highcharts Grid Pro, @highcharts/dashboards (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118247: Highcharts DataTable prototype pollution via column ID

Q: Is there a fix for CVE-2026-118247?

Yes. @highcharts/dashboards (npm): upgrade to 4.2.2 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118247 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118247?

Check whether you run Highcharts Dashboards, Highcharts Grid Pro, @highcharts/dashboards (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118247 · Severity: medium · CVSS 4 · Published 2026-10-28

Highcharts is a popular JavaScript charting library used to display data visualizations on web pages. A flaw in the DataTable component allows attackers with control over table column identifiers to inject malicious values into JavaScript object prototypes, which can alter how the entire application behaves—potentially breaking functionality, redirecting user actions, or corrupting displayed data. This affects Highcharts Dashboards and Grid Pro products used for building interactive dashboards and spreadsheet-like interfaces.

Technologies: Highcharts Dashboards, Highcharts Grid Pro, @highcharts/dashboards (npm), @highcharts/grid-pro (npm). Vendors: Highcharts, npm.

Quick answers

Is CVE-2026-118247 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118247 being exploited in the wild.
How severe is CVE-2026-118247?: Medium severity, with a CVSS score of 4, published 28 October 2026.
Which products and versions are affected?: Highcharts Dashboards 1.0.0 to 4.2.1; Highcharts Grid Pro 2.0.0 to 3.1.x; @highcharts/dashboards (npm) >= 1.0.0, <= 4.2.1, SEMVER:introduced=1.0.0,fixed=4.2.2; @highcharts/grid-pro (npm) >= 2.0.0, <= 3.1.0, SEMVER:introduced=2.0.0,fixed=3.2.0.
Is there a fix for CVE-2026-118247?: Yes. @highcharts/dashboards (npm): upgrade to 4.2.2 or later; @highcharts/grid-pro (npm): upgrade to 3.2.0 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118247 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118247?: Check whether you run Highcharts Dashboards, Highcharts Grid Pro, @highcharts/dashboards (npm) or one of the others listed at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

@highcharts/dashboards (npm): upgrade to 4.2.2 or later
```
npm install @highcharts/dashboards@4.2.2
```
@highcharts/grid-pro (npm): upgrade to 3.2.0 or later
```
npm install @highcharts/grid-pro@3.2.0
```

Technical details

The vulnerability is a prototype pollution flaw in the DataTable.setCell method and related write-back paths in Dashboards and Grid Pro. Attackers can inject the reserved JavaScript identifiers __proto__ or constructor as column IDs, causing integer-indexed values to be written onto Object.prototype or the Object constructor itself. This requires an attacker to control the column ID and trigger a cell write via the table interface, connector write-back, or editing API. The inherited polluted properties affect array and object reads across the page, altering control flow and rendering.

Affected products

Highcharts Dashboards 1.0.0 to 4.2.1
Highcharts Grid Pro 2.0.0 to 3.1.x

Identifiers

CVE-2026-118247
GHSA-c75x-9x9h-28rm

Timeline

2026-10-28: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.