Skip to main content

Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

CVE-2026-118250

High
7.2/10

Summary

A dot-separated key path taken from `series.keys` is followed without filtering the individual segments. An attacker who controls `series.keys` and the matching point data can use a path such as `__proto__.polluted` to set arbitrary properties on `Object.prototype`. The resulting properties are visible to all JavaScript running in the page, not only to the chart. No user interaction is required beyond rendering the chart. This vulnerability affects 6.1.0 prior to 11.4.9, 12.0.0 prior to 12.6.1 and 13.0.0 prior to 13.1.0.

  • LOW
  • NETWORK
  • NONE
  • LOW

CWE-1321 - Prototype Pollution

Prototype pollution is one of the lesser-known vulnerabilities. It allows attackers to abuse the rules of JavaScript by injecting properties into the general object “Object” in JS. Modifying the prototype of “Object” affects the behavior of all objects in the entire app, potentially resulting in denial of service, arbitrary code execution, cross-site scripting, etc.

References

Advisory Timeline

  • Published