Highcharts builds series data columns by using point option keys as column identifiers, which allows user-provided point objects containing enumerable "__proto__" or "constructor" keys to overwrite properties on Object.prototype or the Object constructor. This alteration can change prototype inheritance, disturb for‑in enumeration, and modify how objects are interpreted by the library and the host application. The consequence is that chart rendering may fail or behave inconsistently, and other parts of the application that rely on object enumeration could experience unexpected behavior.

The vulnerability exists in Highcharts library versions 13.0.0 through 13.1.0. It affects any web application that incorporates these versions of the library and renders charts from data that may be supplied or influenced by users.

The CVSS score of 7.2 reflects moderate to high severity, and while the EPSS score is not provided, the vulnerability is not listed in CISA’s KEV catalog. Exploitation requires that an attacker can inject malicious point data into a chart that is rendered in a browser; no additional credentials or privileged access are needed. Once the data is processed by the library, the prototype pollution occurs automatically during rendering.