Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype`

These records connect through source-stated identifiers. Shared identifiers or dates alone do not establish shared exposure, root cause or applicability.

CVE-2026-118243 · Microsoft / collected KEV context

EUVD-2026-112302

GHSA-jqgh-w3cc-7jqw

cve-program · CVE-2026-118243

• https://github.com/highcharts/highcharts/security/advisories/GHSA-jqgh-w3cc-7jqw
• https://github.com/highcharts/highcharts/commit/ade5a41a700212f09133223ca990a3737d1d9ec6
• https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2

euvd · EUVD-2026-112302

• https://github.com/highcharts/highcharts/security/advisories/GHSA-jqgh-w3cc-7jqw
• https://github.com/highcharts/highcharts/commit/ade5a41a700212f09133223ca990a3737d1d9ec6
• https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2

nvd · CVE-2026-118243

• https://github.com/highcharts/highcharts/commit/ade5a41a700212f09133223ca990a3737d1d9ec6
• https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2
• https://github.com/highcharts/highcharts/security/advisories/GHSA-jqgh-w3cc-7jqw

osv · GHSA-jqgh-w3cc-7jqw

• https://github.com/highcharts/highcharts/security/advisories/GHSA-jqgh-w3cc-7jqw
• https://nvd.nist.gov/vuln/detail/CVE-2026-118243
• https://github.com/highcharts/highcharts/commit/ade5a41a700212f09133223ca990a3737d1d9ec6
• https://github.com/highcharts/highcharts
• https://github.com/highcharts/highcharts/releases/tag/dashboards-v4.2.2

• Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool conn… · Advisory content revised · 5 Nov 2026
• Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool conn… · Advisory content revised · 3 Nov 2026
• Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool conn… · Advisory content revised · 30 Oct 2026
• Highcharts JS is a JavaScript charting library based on SVG. From 1.0.0 until 4.2.2, Highcharts Dashboards stores DataCursor listener and state maps in plain objects keyed by DataTable ID. A __proto__ table ID supplied through dataPool conn… · Advisory content revised · 30 Oct 2026
• Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` · Newly collected advisory · 28 Oct 2026
• Highcharts Dashboards: `__proto__` data table id writes sync listeners to `Object.prototype` · Newly collected advisory · 28 Oct 2026