Highcharts Dashboards, from 1.0.0 through 4.2.2, does not reject prototype‑related keys in the editableOptions propertyPath, allowing an attacker who can influence those options to traverse keys such as __proto__ or constructor. When an edit writes a configured value onto Object.prototype, the property becomes globally accessible to every JavaScript context on the page. Depending on the consuming application, this prototype pollution can lead to arbitrary code execution, data leaks, or denial of service. The vulnerability is an instance of CWE‑1321: Prototype Pollution.

The issue affects the Highcharts Dashboards and Highcharts charting library for any installation configured to allow editing of chart options. Versions 1.0.0 through 4.2.2 are vulnerable; a fix was included in release 4.2.2.

The CVSS score of 6.9 indicates a moderate severity. EPSS is not available, and the vulnerability is not listed in CISA’s KEV catalog. The attack requires that an attacker can supply or modify editableOptions, a condition that is typically met when the application exposes chart editing to a user or processes untrusted data. If successful, prototype pollution can compromise the entire JavaScript execution environment of the page, making the risk significant in scenarios where the library is used in a web interface that handles user‑generated content.