An attacker can inject malicious script or alter the JavaScript prototype by supplying crafted data through Highcharts chart configuration options. The vulnerabilities allow writes to Object.prototype via dotted series.keys paths and enable classic cross‑site scripting through credits.href, breadcrumbs.style, HTML text parsing, and xlink:href attributes in exported charts. This can give a remote attacker the ability to execute arbitrary code in the victim’s browser context or manipulate the application’s data model, potentially compromising user sessions and sensitive data.

Affected products include the Vaadin platform and its chart components: Vaadin (vaadin, vaadin-charts-flow, vaadin-charts-flow-svg-generator) and the npm package @vaadin/charts. Vulnerable releases span Vaadin 22.0.0 through 23.6.15, Vaadin 24.0.0 through 24.7.15, Vaadin 24.8.0 through 24.9.22, Vaadin 24.10.0 through 24.10.10, Vaadin 25.0.0 through 25.2.9, and Vaadin 25.3.0, along with the corresponding npm versions from @vaadin/charts 22.0.0 to 25.3.0. The fixed versions start at Vaadin 23.6.16, 24.4.24, 24.7.16, 24.9.23, 24.10.11, 25.2.10, and 25.3.1 or newer; for npm, the equivalents are @vaadin/charts >=25.3.1.

The CVSS score of 8.4 indicates high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog, suggesting no widely known active exploitation at this time. The likely attack vector is that an application provider includes attacker‑controlled data in the chart configuration—via properties such as additionalOptions, updateConfiguration(), or markup‑accepting text fields—allowing the vulnerable Highcharts library to process it unsanitized. An attacker with the ability to influence these inputs can trigger the prototype pollution or XSS flaws, potentially leading to remote code execution within the end‑user’s browser.