CVE-2026-118247

Highcharts Dashboards / Grid Pro: DataTable.setCell and column writers treat proto as an existing column.

function stripUnsafeColumnIds(columns) {
    for (const key of ['__proto__', 'constructor']) {
        if (Object.prototype.hasOwnProperty.call(columns, key)) {
            delete columns[key];
        }
    }

    return columns;
}

Grid.grid('container', {
    data: { columns: stripUnsafeColumnIds(untrustedColumns) }
});

{
    const { DataTable } = Grid; // Or Dashboards

    if (!DataTable) {
        throw new Error('Patch loaded before Grid');
    }

    const unsafe = (id) => id === '__proto__' || id === 'constructor';

    const setCell = DataTable.prototype.setCell;
    DataTable.prototype.setCell = function (columnId, ...rest) {
        if (unsafe(columnId)) {
            return;
        }
        return setCell.call(this, columnId, ...rest);
    };

    const changeColumnId = DataTable.prototype.changeColumnId;
    DataTable.prototype.changeColumnId = function (columnId, newColumnId) {
        if (unsafe(columnId) || unsafe(newColumnId)) {
            return false;
        }
        return changeColumnId.call(this, columnId, newColumnId);
    };

    const setColumns = DataTable.prototype.setColumns;
    DataTable.prototype.setColumns = function (columns, ...rest) {
        const safe = {};

        for (const key of Object.keys(columns || {})) {
            if (!unsafe(key)) {
                safe[key] = columns[key];
            }
        }

        return setColumns.call(this, safe, ...rest);
    };
}

When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of __proto__ resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.prototype; a column id of constructor writes onto the Object constructor in the same way. In Dashboards releases that still supported column aliases, the id is first resolved through the alias map, so a literal __proto__ id is redirected harmlessly there, while an alias whose target is __proto__, which the connector's data table options accept, reaches the same write. An attacker who controls the column id can thereby set integer-keyed properties on Object.prototype, one per row index, holding the written value; named properties cannot be reached through these paths, because the row index is a number. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the injected value, and for...in over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. In Dashboards the write is reached through the Highcharts component's connector write-back, which is enabled by default through allowConnectorUpdate and takes the column id from the component's columnAssignment, or in the earliest releases from the series name, when a point is updated; in Grid Pro it is reached through cell editing in earlier releases and remains reachable through the public DataTable API. Exploitation requires that untrusted data reach the board or Grid configuration and that a point be updated or a cell edited, or that the application write a cell with an untrusted column id.

Consequences beyond disruption depend on the consuming application.

Kodem intelligence

Already deployed Kodem?

1. What is CVE-2026-118247? CVE-2026-118247 is a medium-severity security vulnerability in @highcharts/dashboards (npm), affecting versions >= 1.0.0, <= 4.2.1. It is fixed in 4.2.2, 3.2.0.
2. Which packages are affected by CVE-2026-118247?
   • @highcharts/dashboards (npm) (versions >= 1.0.0, <= 4.2.1)
   • @highcharts/grid-pro (npm) (versions >= 2.0.0, <= 3.1.0)
3. Is there a fix for CVE-2026-118247? Yes. CVE-2026-118247 is fixed in 4.2.2, 3.2.0. Upgrade to this version or later.
4. Is CVE-2026-118247 exploitable, and should I be worried? Whether CVE-2026-118247 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
5. What actually determines whether CVE-2026-118247 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
6. How do I fix CVE-2026-118247?
   • Upgrade @highcharts/dashboards to 4.2.2 or later
   • Upgrade @highcharts/grid-pro to 3.2.0 or later

Other vulnerabilities in @highcharts/dashboards