# CVE-2026-118250: Highcharts JS prototype pollution via dotted series keys

Source: https://junglewise.ai/threats/cve-2026-118250-highcharts-js-is-a-javascript-charting-library-based-on-svg-from  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-28. Updated: 2026-10-28  
License: CC BY 4.0 with a link back

CVE-2026-118250 · Severity: high · CVSS 4 · Published 2026-10-28

Highcharts is a JavaScript charting library used to display interactive charts and graphs in web applications. A vulnerability allows attackers who can control chart configuration to inject malicious properties into JavaScript's Object.prototype, affecting all scripts on the page and potentially leading to data theft, session hijacking, or malicious behavior without requiring user interaction.

Technologies: [Highcharts JS](https://junglewise.ai/threats/technologies/highcharts-highcharts-js), [highcharts (npm)](https://junglewise.ai/threats/technologies/highcharts). Vendors: [Highcharts](https://junglewise.ai/threats/vendors/highcharts), [npm](https://junglewise.ai/threats/vendors/npm).

## Quick answers

**Is CVE-2026-118250 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-118250 being exploited in the wild.

**How severe is CVE-2026-118250?** High severity, with a CVSS score of 4, published 28 October 2026.

**Which products and versions are affected?** Highcharts JS 6.1.0 to 11.4.8, 12.0.0 to 12.6.0, 3.0.0 to 3.0.13; highcharts (npm) >= 12.0.0, < 12.6.1, SEMVER:introduced=12.0.0,fixed=12.6.1.

**Is there a fix for CVE-2026-118250?** Yes. highcharts (npm): upgrade to 12.6.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-118250 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-118250?** Check whether you run Highcharts JS or highcharts (npm) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- highcharts (npm): upgrade to 12.6.1 or later

  ```sh
  npm install highcharts@12.6.1
  ```


## Technical details

The vulnerability is a prototype pollution issue in the Point.setNestedProperty method, which processes dot-separated paths in series.keys without filtering dangerous segments like __proto__ or constructor. An attacker can craft a chart configuration with keys like __proto__.polluted to assign arbitrary properties to Object.prototype. The fix rejects entire key paths containing __proto__ or constructor segments, matching existing protections in the merge() method.

## Affected products

- Highcharts Highcharts JS 6.1.0 to 11.4.8, 12.0.0 to 12.6.0, 3.0.0 to 3.0.13

## Identifiers

- CVE-2026-118250
- GHSA-rmqc-xvr3-v46c

## Timeline

- 2026-10-28: disclosed
- 2026-09-10: patched: Fix merged to master branch

## References

- [https://github.com/highcharts/highcharts/commit/fd4ee8140732618bbe71295aba55398fb1f8fa9e](https://github.com/highcharts/highcharts/commit/fd4ee8140732618bbe71295aba55398fb1f8fa9e)
- [https://github.com/highcharts/highcharts/pull/25313](https://github.com/highcharts/highcharts/pull/25313)

## Related threats

- [Highcharts JavaScript library cross-site scripting in credits link](https://junglewise.ai/threats/cve-2026-118251-highcharts-js-is-a-javascript-charting-library-based-on-svg)
- [Highcharts JS prototype pollution in series data](https://junglewise.ai/threats/cve-2026-118249-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts JavaScript event handler injection via breadcrumbs](https://junglewise.ai/threats/cve-2026-118246-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts JS cross-site scripting via innerHTML fallback on print](https://junglewise.ai/threats/cve-2026-118244-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)
- [Highcharts JS unfiltered xlink:href in exported SVG](https://junglewise.ai/threats/cve-2026-116796-highcharts-js-is-a-javascript-charting-library-based-on-svg-from)