Highcharts DataTable single-cell writers interpret the string "__proto__" as a legitimate column identifier. Because the value is not validated against the prototype chain, an attacker who can influence the column ID or the data written to the cell can assign values to Object.prototype or the Object constructor. Assigning properties on those prototypes can modify how arrays and objects are enumerated or accessed, potentially altering the application’s control flow or rendering logic. This is a prototype-pollution weakness (CWE-1321). The CVSS score of 6.9 reflects this moderate-to-high impact.

Vendors affected include Highcharts’ Dashboards and Grid Pro components. The vulnerability is present in Dashboards versions 1.0.0 through 4.2.1 and in Grid Pro versions 2.0.0 through 3.1.9. It was fixed in Dashboards 4.2.2 and Grid Pro 3.2.0, but many customers remain on earlier releases. Any deployment that uses the DataTable module with untrusted column identifiers is susceptible.

The vulnerability is not listed in CISA KEV, but the CVSS score of 6.9 indicates a significant risk. Exploitation requires an attacker’s ability to influence a DataTable column identifier or data value – for example, via an API write, a form that feeds data into the table, or a user-editable grid cell. If that control exists in a web application, the attacker can trigger prototype pollution and subsequently manipulate the application’s behavior or inject code. The attack vector is client-side, but it can have server-side consequences if the polluted prototypes are serialized or evaluated.