CVE-2026-118243

Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool connector configuration resolves to Object.prototype, and sync registration creates an enumerable property there whose suffix can be influenced through the sync group option. The property is visible on every object, and lasting sync states can throw and stop features such as extremes synchronization. Exploitation requires untrusted dashboard configuration and an enabled component sync, but no user interaction beyond loading the board. This issue is fixed in 4.2.2.

• CWE-1321

• https://github.com/highcharts/highcharts/commit/ade5a41a700212f09133223ca990a3737d1d9ec6
• https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2
• https://github.com/highcharts/highcharts/security/advisories/GHSA-jqgh-w3cc-7jqw

Published

Oct 28, 2026

Last Modified

Oct 29, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-11820A flaw was found in the community.general Ansible collection…6.5
• CVE-2026-11821The Eventin – Event Calendar, Event Registration, Tickets & …5.4
• CVE-2026-11822SQLite before 3.53.2 contains memory corruption vulnerabilit…7.8
• CVE-2026-11823The BookingPress Appointment Booking Pro plugin for WordPres…7.5
• CVE-2026-11824SQLite before 3.53.2 contains a heap-based buffer overflow v…7.8
• CVE-2026-118242Highcharts JS is a JavaScript charting library based on SVG.…8.5
• CVE-2026-118244Highcharts JS is a JavaScript charting library based on SVG.…7.2
• CVE-2026-118245Highcharts JS is a JavaScript charting library based on SVG.…8.6
• CVE-2026-118246Highcharts JS is a JavaScript charting library based on SVG.…8.4
• CVE-2026-118247Highcharts JS is a JavaScript charting library based on SVG.…6.9
• CVE-2026-118248Highcharts JS is a JavaScript charting library based on SVG.…6.9
• CVE-2026-118249Highcharts JS is a JavaScript charting library based on SVG.…7.2