{"items":[{"id":"NVI-00008890","kind":"vulnerability","title":"Highcharts: series column construction writes to Object.prototype","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-gfvx-2c2g-38wq","CVE-2026-118249"],"plain_summary":"GitHub lists this reviewed advisory for highcharts. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1d4464aa1456f8dc77e65129eb91e644"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 13.1.0 for highcharts. Confirm the publisher’s latest guidance.","source_ids":["sr-0952dc51a8d46b5dba0ca30021d2cacd"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1d4464aa1456f8dc77e65129eb91e644","url":"https://github.com/advisories/GHSA-gfvx-2c2g-38wq","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-gfvx-2c2g-38wq","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"},{"id":"sr-0952dc51a8d46b5dba0ca30021d2cacd","url":"https://github.com/advisories/GHSA-gfvx-2c2g-38wq","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-gfvx-2c2g-38wq","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-11-01T19:09:41.641Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1d4464aa1456f8dc77e65129eb91e644"],"technology":"highcharts","known_exclusions":[],"conditions_summary":"### Impact\nWhen series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches `Object.prototype` and the `Object` constructor. Keys named `__proto__` and `constructor` survive `JSON.parse` as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on `Object.prototype`, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the attacker's value, and `for...in` over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. The properties remain in place once the chart has been built, and no user interaction is required beyond rendering the chart.\n\nConsequences beyond disruption depend on the consuming application.\n\n### Workarounds\nDrop-in fix - for any versions affected (6.1.0-13.0.2).\nAdd the below IIFE to run after Highcharts is loaded.\n\n```javascript\n;!function(t){if(t&&t.Point&&!t.Poin","public_affected_ranges":[">= 13.0.0, <= 13.0.2"]},{"certainty":"source_listed","source_ids":["sr-0952dc51a8d46b5dba0ca30021d2cacd"],"technology":"highcharts","known_exclusions":[],"conditions_summary":"### Impact\nWhen series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches `Object.prototype` and the `Object` constructor. Keys named `__proto__` and `constructor` survive `JSON.parse` as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on `Object.prototype`, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the attacker's value, and `for...in` over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. The properties remain in place once the chart has been built, and no user interaction is required beyond rendering the chart.\n\nConsequences beyond disruption depend on the consuming application.\n\n### Workarounds\nDrop-in fix - for any versions affected (6.1.0-13.0.2).\nAdd the below IIFE to run after Highcharts is loaded.\n\n```javascript\n;!function(t){if(t&&t.Point&&!t.Poin","public_affected_ranges":["SEMVER: introduced 13.0.0; fixed 13.1.0"]}],"null_published_at":"2026-11-02T20:21:10.344Z","source_updated_at":"2026-10-28T19:56:15.000Z","source_disclosed_at":"2026-10-28T19:56:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Source facts changed; compare the preserved prior revision.","null_first_observed_at":"2026-10-31T21:56:08.420Z"},{"id":"NVI-00008890","kind":"vulnerability","title":"Highcharts: series column construction writes to Object.prototype","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-gfvx-2c2g-38wq","CVE-2026-118249"],"plain_summary":"GitHub lists this reviewed advisory for highcharts. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-1d4464aa1456f8dc77e65129eb91e644"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-1d4464aa1456f8dc77e65129eb91e644","url":"https://github.com/advisories/GHSA-gfvx-2c2g-38wq","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-gfvx-2c2g-38wq","publisher":"GitHub Advisory Database","observed_at":"2026-10-31T21:56:08.420Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-1d4464aa1456f8dc77e65129eb91e644"],"technology":"highcharts","known_exclusions":[],"conditions_summary":"### Impact\nWhen series columns are built from point objects, the point option keys are used directly as data column ids, so the write that populates a column reaches `Object.prototype` and the `Object` constructor. Keys named `__proto__` and `constructor` survive `JSON.parse` as own enumerable properties, so an attacker who controls the point objects can set integer-keyed properties on `Object.prototype`, one per point index, to values of their choosing. Named properties cannot be reached this way. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the attacker's value, and `for...in` over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. The properties remain in place once the chart has been built, and no user interaction is required beyond rendering the chart.\n\nConsequences beyond disruption depend on the consuming application.\n\n### Workarounds\nDrop-in fix - for any versions affected (6.1.0-13.0.2).\nAdd the below IIFE to run after Highcharts is loaded.\n\n```javascript\n;!function(t){if(t&&t.Point&&!t.Poin","public_affected_ranges":[">= 13.0.0, <= 13.0.2"]}],"null_published_at":"2026-10-31T22:13:27.121Z","source_updated_at":"2026-10-28T19:56:15.000Z","source_disclosed_at":"2026-10-28T19:56:13.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:56:08.420Z"}],"next_cursor":null,"snapshot_revision":"42594"}