{"affected":[{"product":"highcharts","source":"CNA: GitHub_M","vendor":"highcharts","versions":[{"status":"affected","version":"< 13.1.0"}]},{"product":"dashboards","source":"CNA: GitHub_M","vendor":"@highcharts","versions":[{"status":"affected","version":">= 1.0.0, < 4.2.3"}]},{"product":"grid-pro","source":"CNA: GitHub_M","vendor":"@highcharts","versions":[{"status":"affected","version":">= 2.0.0, < 3.2.0"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@highcharts/dashboards","product":"@highcharts/dashboards","source":"OSV GHSA-c75x-9x9h-28rm","vendor":"","versions":[{"events":[{"introduced":"1.0.0"},{"fixed":"4.2.2"}],"lessThan":"4.2.2","status":"affected","version":"1.0.0","versionType":"semver"}]},{"defaultStatus":"unaffected","ecosystem":"npm","packageName":"@highcharts/grid-pro","product":"@highcharts/grid-pro","source":"OSV GHSA-c75x-9x9h-28rm","vendor":"","versions":[{"events":[{"introduced":"2.0.0"},{"fixed":"3.2.0"}],"lessThan":"3.2.0","status":"affected","version":"2.0.0","versionType":"semver"}]}],"cveId":"CVE-2026-118247","cwes":["CWE-1321"],"description":"Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until Dashboards 4.2.2, and from 2.0.0 until Grid Pro 3.2.0, Highcharts DataTable single-cell writers use an untrusted column ID as a key without rejecting __proto__ or constructor. DataTable.setCell, including Dashboards connector write-back and Grid Pro editing paths, can therefore write integer-indexed values onto Object.prototype or the Object constructor. In Dashboards releases with column aliases, a literal __proto__ ID is redirected by the alias map, while an alias targeting __proto__ reaches the unsafe write; later releases without aliases accept the unsafe ID directly. Those inherited values affect array and object reads and for-in enumeration throughout the page, which can alter application control flow or disrupt rendering. Exploitation requires control of the table or component column ID and a cell, point, or API write. This issue is fixed in Dashboards 4.2.2 and Grid Pro 3.2.0.","epss":{"date":"2026-11-02","percentile":0.30147,"score":0.00363},"exploits":[],"kev":null,"metrics":[{"score":6.9,"severity":"medium","source":"CNA: GitHub_M","vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L","version":"4.0"}],"modifiedAt":1793651244621,"publishedAt":1793209859526,"references":[{"source":"CNA: GitHub_M","tags":["x_refsource_CONFIRM"],"url":"https://github.com/highcharts/highcharts/security/advisories/GHSA-c75x-9x9h-28rm"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/highcharts/highcharts/commit/02dd9349aeb6f4cc9c98806120d917ed316b4c74"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2"},{"source":"CNA: GitHub_M","tags":["x_refsource_MISC"],"url":"https://github.com/highcharts/highcharts/releases/tag/grid-v3.2.0"},{"source":"OSV / GitHub Security Advisories","tags":["advisory"],"url":"https://github.com/advisories/GHSA-c75x-9x9h-28rm"},{"source":"OSV / GitHub Security Advisories","tags":["osv"],"url":"https://osv.dev/vulnerability/GHSA-c75x-9x9h-28rm"}],"remediation":[{"kind":"fix","source":"OSV GHSA-c75x-9x9h-28rm","text":"@highcharts/dashboards (npm): OSV reports a fixed version 4.2.2. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-c75x-9x9h-28rm"},{"kind":"fix","source":"OSV GHSA-c75x-9x9h-28rm","text":"@highcharts/grid-pro (npm): OSV reports a fixed version 3.2.0. Check the advisory for supported release branches.","url":"https://github.com/advisories/GHSA-c75x-9x9h-28rm"}],"revision":"30bcf217fd7904d9843fb7d5f021a55a2d27b337e6981522f799faeb8205a5fb","sources":[{"modifiedAt":1793651244621,"name":"CNA: GitHub_M","retrievedAt":1793653747174,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118247"},{"modifiedAt":1793218505454,"name":"OSV / GitHub Security Advisories","retrievedAt":1793653749708,"url":"https://osv.dev/vulnerability/GHSA-c75x-9x9h-28rm"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1793653781679,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118247"}],"ssvc":{"assessedAt":1793651235345,"automatable":"yes","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.","updatedAt":1793653781679}