Is CVE-2026-118250 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-118250 being exploited in the wild.

How severe is CVE-2026-118250?

High severity, with a CVSS score of 4, published 28 October 2026.

Which products and versions are affected?

Highcharts JS 6.1.0 to 11.4.8, 12.0.0 to 12.6.0, 3.0.0 to 3.0.13; highcharts (npm) >= 12.0.0, < 12.6.1, SEMVER:introduced=12.0.0,fixed=12.6.1.

Is there a fix for CVE-2026-118250?

Yes. highcharts (npm): upgrade to 12.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-118250 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-118250?

Check whether you run Highcharts JS or highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118250: Highcharts JS prototype pollution via dotted series keys

Q: Is there a fix for CVE-2026-118250?

Yes. highcharts (npm): upgrade to 12.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-118250 attacked?

It is attacked over the network, in a software library.

Q: Am I affected by CVE-2026-118250?

Check whether you run Highcharts JS or highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-118250 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts is a JavaScript charting library used to display interactive charts and graphs in web applications. A vulnerability allows attackers who can control chart configuration to inject malicious properties into JavaScript's Object.prototype, affecting all scripts on the page and potentially leading to data theft, session hijacking, or malicious behavior without requiring user interaction.

Technologies: Highcharts JS, highcharts (npm). Vendors: Highcharts, npm.

Quick answers

Is CVE-2026-118250 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-118250 being exploited in the wild.
How severe is CVE-2026-118250?: High severity, with a CVSS score of 4, published 28 October 2026.
Which products and versions are affected?: Highcharts JS 6.1.0 to 11.4.8, 12.0.0 to 12.6.0, 3.0.0 to 3.0.13; highcharts (npm) >= 12.0.0, < 12.6.1, SEMVER:introduced=12.0.0,fixed=12.6.1.
Is there a fix for CVE-2026-118250?: Yes. highcharts (npm): upgrade to 12.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-118250 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-118250?: Check whether you run Highcharts JS or highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

highcharts (npm): upgrade to 12.6.1 or later
```
npm install highcharts@12.6.1
```

Technical details

The vulnerability is a prototype pollution issue in the Point.setNestedProperty method, which processes dot-separated paths in series.keys without filtering dangerous segments like __proto__ or constructor. An attacker can craft a chart configuration with keys like __proto__.polluted to assign arbitrary properties to Object.prototype. The fix rejects entire key paths containing __proto__ or constructor segments, matching existing protections in the merge() method.

Affected products

Highcharts Highcharts JS 6.1.0 to 11.4.8, 12.0.0 to 12.6.0, 3.0.0 to 3.0.13

Identifiers

CVE-2026-118250
GHSA-rmqc-xvr3-v46c

Timeline

2026-10-28: disclosed
2026-09-10: patched: Fix merged to master branch

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.