https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 29 Oct 2026 23:41:04 +0000 https://db.gcve.eu/vuln/ghsa-c75x-9x9h-28rm <p><strong>Affected:</strong> npm: @highcharts/dashboards, npm: @highcharts/grid-pro</p> <p>### Impact When a single cell value is written to a data table, the column id is used as a key on the table&#39;s column collection without filtering, so a column id of `__proto__` resolves to `Object.prototype`, is taken for an existing column, and the write lands at the row index on `Object.prototype`; a column id of `constructor` writes onto the `Object` constructor in the same way. In Dashboards releases that still supported column aliases, the id is first resolved through the alias map, so a literal `__proto__` id is redirected harmlessly there, while an alias whose target is `__proto__`, which the connector&#39;s data table options accept, reaches the same write. An attacker who controls the column id can thereby set integer-keyed properties on `Object.prototype`, one per row index, holding the written value; named properties cannot be reached through these paths, because the row index is a number. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the injected value, and `for...in` over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. In Dashboards the write is reached through the Highcharts component&#39;s connector write-back, which is enabled by default through `allowConnectorUpdate` and takes the column id from the component&#39;s `columnAssignment`, or in the earliest releases from the series name, wh…</p> <p><strong>Affected:</strong> npm: @highcharts/dashboards, npm: @highcharts/grid-pro</p> <p>### Impact When a single cell value is written to a data table, the column id is used as a key on the table&#39;s column collection without filtering, so a column id of `__proto__` resolves to `Object.prototype`, is taken for an existing column, and the write lands at the row index on `Object.prototype`; a column id of `constructor` writes onto the `Object` constructor in the same way. In Dashboards releases that still supported column aliases, the id is first resolved through the alias map, so a literal `__proto__` id is redirected harmlessly there, while an alias whose target is `__proto__`, which the connector&#39;s data table options accept, reaches the same write. An attacker who controls the column id can thereby set integer-keyed properties on `Object.prototype`, one per row index, holding the written value; named properties cannot be reached through these paths, because the row index is a number. The integer keys still affect every object in the page: reading an out-of-range index on any array or plain object returns the injected value, and `for...in` over any object yields the injected keys, so unrelated code can take branches it should not using attacker-supplied data, and rendering can fail as a side effect. In Dashboards the write is reached through the Highcharts component&#39;s connector write-back, which is enabled by default through `allowConnectorUpdate` and takes the column id from the component&#39;s `columnAssignment`, or in the earliest releases from the series name, wh…</p> https://db.gcve.eu/vuln/ghsa-c75x-9x9h-28rm