CVE-2026-118248
Description
A flaw was found in Highcharts Dashboards. The edit mode component fails to properly validate object property paths, allowing prototype-related keys to be processed. An attacker who controls editable configuration options can supply crafted paths to modify base JavaScript object prototypes (prototype pollution). This manipulation alters global application properties, potentially leading to a Denial of Service (DoS) or unexpected behavior across the consuming web application.
Statement
Red Hat Product Security rates the severity of this vulnerability as Moderate because exploitation requires an attacker to control specific configuration options and relies on user interaction within dashboard edit mode. The blast radius is confined to the client-side JavaScript execution environment, preventing direct compromise of host systems or backend infrastructure. Consequently, the impact is primarily limited to potential client-side denial of service or erratic application behavior during an active session.
Understanding the Weakness (CWE)
Integrity
Technical Impact: Modify Application Data
An attacker could modify sensitive data or program variables.
Integrity
Technical Impact: Execute Unauthorized Code or Commands
Other,Integrity
Technical Impact: Varies by Context; Alter Execution Logic
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
