KEVWire

Security intelligence, with context.

Response snapshot Oct 29, 2026, 01:26 UTC

Back to the wire
Permalink
VulnerabilityCVE-2026-118247

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column.

When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of proto resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.

Published Updated

At a glance

Exploited
Not known
Severity
6.9 Medium (CVSS 4.0)
Chance of exploitation
Not estimated
Sources
1 source

What to do

GitHub lists first patched versions: @highcharts/dashboards: 4.2.2; @highcharts/grid-pro: 3.2.0. Confirm the affected range and upgrade guidance in the exact advisory.

Read GitHub-reviewed advisory GHSA-c75x-9x9h-28rm (opens a new tab)

What happened

Impact

When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of proto resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.prototype; a column id of constructor writes onto the Object constructor in the same way.

In Dashboards releases that still supported column aliases, the id is first resolved through the alias map, so a literal proto id is redirected harmlessly there, while an alias whose target is proto, which the connector's data table options accept, reaches the same write. An attacker who controls the column id can thereby set integer-keyed properties on Object.

prototype, one per row index, holding the written value; named properties cannot be reached through these paths, because the row index is a number. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the injected value, and for...

Continue reading

in over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect.

In Dashboards the write is reached through the Highcharts component's connector write-back, which is enabled by default through allowConnectorUpdate and takes the column id from the component's columnAssignment, or in the earliest releases from the series name, when a point is updated; in Grid Pro it is reached through cell editing in earlier releases and remains reachable through the public DataTable API.

Exploitation requires that untrusted data reach the board or Grid configuration and that a point be updated or a cell edited, or that the application write a cell with an untrusted column id.

Consequences beyond disruption depend on the consuming application.

Workarounds

Two measures are needed. The first closes the paths that reach Object.prototype; the second covers table construction, which cannot be patched from outside the library.

1. Strip unsafe keys from untrusted column data

Apply this wherever column data enters your application, before it is handed to a grid, board or DataTable. This is the only measure that covers the DataTable constructor.

function stripUnsafeColumnIds(columns) {
 for (const key of ['__proto__', 'constructor']) {
 if (Object.prototype.hasOwnProperty.call(columns, key)) {
 delete columns[key];
 }
 }

 return columns;
}

Grid.grid('container', {
 data: { columns: stripUnsafeColumnIds(untrustedColumns) }
});

2. Patch the DataTable methods

Needed if your application passes column ids that originate from untrusted input to setCell, changeColumnId or setColumns. Run it once at startup.

{
 const { DataTable } = Grid; // Or Dashboards

 if (!DataTable) {
 throw new Error('Patch loaded before Grid');
 }

 const unsafe = (id) => id === '__proto__' || id === 'constructor';

 const setCell = DataTable.prototype.setCell;
 DataTable.prototype.setCell = function (columnId, ...rest) {
 if (unsafe(columnId)) {
 return;
 }
 return setCell.call(this, columnId, ...rest);
 };

 const changeColumnId = DataTable.prototype.changeColumnId;
 DataTable.prototype.changeColumnId = function (columnId, newColumnId) {
 if (unsafe(columnId) || unsafe(newColumnId)) {
 return false;
 }
 return changeColumnId.call(this, columnId, newColumnId);
 };

 const setColumns = DataTable.prototype.setColumns;
 DataTable.prototype.setColumns = function (columns, ...rest) {
 const safe = {};

 for (const key of Object.keys(columns || {})) {
 if (!unsafe(key)) {
 safe[key] = columns[key];
 }
 }

 return setColumns.call(this, safe, ...rest);
 };
}

For npm, take DataTable from your import instead of the global — it is exported by Grid Lite, Grid Pro and Dashboards alike.

Obtaining the patched version

The patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example npm install @highcharts/dashboards@4.2.2. If you load Highcharts Dashboards from a CDN, use a versioned URL, for example https://code.highcharts.com/dashboards/4.2.2/dashboards.js. For more on each installation method, see the [installation guide](https://www.highcharts.com/docs/dashboards/installation).

Affected package ranges reported by GitHub: @highcharts/dashboards: >= 1.0.0, <= 4.2.1 @highcharts/grid-pro: >= 2.0.0, <= 3.1.0

Scores and how they were measured

CVSS base severity

6.9

Version 4.0As of

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:L/VA:H/SC:L/SI:L/SA:L

Measurement source (opens a new tab)

How bad it is if exploited. Not a prediction of exploitation or proof you are exposed.

EPSS probability

Not available

A model's estimate of exploitation in the next 30 days, not certainty or your own risk.

Related technology

Follow JavaScript packages (npm): RSS feedAll its recordsAsk your AI assistant

Sources

  1. Primary source

    GitHub-reviewed advisory GHSA-c75x-9x9h-28rm (opens a new tab)

    The public advisory supplies the description, affected package/version ranges, and any listed CVSS metric. GitHub review is not local review.

    Published Checked

  2. Primary source

    GitHub public advisory API page (opens a new tab)

    The API page supplied GHSA-c75x-9x9h-28rm, its actual identifiers, source dates, and structured metrics.

    Published Date not suppliedChecked

Cite this record

For factual claims, cite the primary sources above; cite KEVWire for its compilation, dates, and classifications.

APA

KEVWire. (2026, October 28). Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. (CVE-2026-118247). https://kevwire.com/record/CVE-2026-118247

MLA

"Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. (CVE-2026-118247)." KEVWire, 28 Oct. 2026, kevwire.com/record/CVE-2026-118247.

Chicago

KEVWire. "Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. (CVE-2026-118247)." Last modified October 28, 2026. https://kevwire.com/record/CVE-2026-118247.

Evidence summary (plain text)

Highcharts Dashboards / Grid Pro: `DataTable.setCell` and column writers treat `__proto__` as an existing column. (Oct 28, 2026).
When a single cell value is written to a data table, the column id is used as a key on the table's column collection without filtering, so a column id of proto resolves to Object.prototype, is taken for an existing column, and the write lands at the row index on Object.prototype; a column id of constructor writes onto the Object constructor in the same way.
CVSS 6.9 (version 4.0; evidence as of Oct 28, 2026; https://github.com/advisories/GHSA-c75x-9x9h-28rm).
Sources:
GitHub-reviewed advisory GHSA-c75x-9x9h-28rm: https://github.com/advisories/GHSA-c75x-9x9h-28rm
GitHub public advisory API page: https://api.github.com/advisories?type=reviewed&per_page=100&sort=updated&direction=desc
Record ID: CVE-2026-118247.
Record origin: Ingested record.
AI evidence: Not assessed.
Known exploitation: Not assessed.
Zero-day status: Not assessed. KEV membership alone does not establish zero-day status.
About this data

This record was ingested from a data source. Retrieved: Oct 29, 2026, 00:55 UTC. Ingestion is not an independent editorial investigation.

A CISA KEV listing documents known exploitation, not necessarily a zero-day; absence from the catalog does not prove a vulnerability has never been exploited.

Technology tags indicate possible relevance, not verified exposure. Confirm the affected product, version, and configuration against your own inventory; KEVWire does not scan your systems.

A personal reading checklist on this device, not verified remediation.

Record JSON

Your account

Email alerts

Email alerts are coming as part of KEVWire Premium: join the waitlist. To follow your stack today, use its RSS feed, which honors your filters, or connect an AI agent through the API.

Suggest an improvement

Ideas, missing sources, corrections, and bugs are all welcome. No account needed. Suggestions are reviewed by a person before anything changes.

Record details

Record detail