Highcharts JavaScript libraries from 6.1.0 up to 11.4.9, 12.6.1, and 3.1.0 process dot‑separated series.keys paths without filtering each segment; an attacker who controls series.keys and matching point data can include "__proto__" in the path to assign properties to Object.prototype. This prototype poisoning renders the additional properties visible to all JavaScript on the page, enabling arbitrary code execution or data manipulation. The vulnerability is triggered automatically during chart rendering, without any user interaction beyond delivering the chart data.

The affected product is Highcharts from the vendor highcharts. All release versions from 6.1.0 through 11.4.9, the 12.6.1 release, and the 3.1.0 release are vulnerable. The fix was applied in 11.4.9, 12.6.1, and 3.1.0.

The CVSS score of 7.2 reflects a high risk of exploitation, and the missing EPSS score means the exact probability is unknown, but the vulnerability is exploitable in any context where an attacker can supply chart data. It is not listed in the CISA KEV catalog. The attack vector is client‑side: an attacker can embed a crafted chart in a web page, and the flaw will modify Object.prototype during the rendering process, affecting all JavaScript on that page.