GHSA-rmqc-xvr3-v46c Highcharts: dotted series.keys paths write to Object.prototype

• npm highcharts: >= 12.0.0, < 12.6.1 → fixed in 12.6.1 • npm highcharts: >= 13.0.0, < 13.1.0 → fixed in 13.1.0 • npm highcharts: >= 6.1.0, < 11.4.9 → fixed in 11.4.9

Impact A dot-separated key path taken from `series.keys` is followed without filtering the individual segments. An attacker who controls `series.keys` and the matching point data can use a path such as `__proto__.polluted` to set arbitrary properties on `Object.prototype`. The resulting properties are visible to all JavaScript running in the page, not only to the chart. No user interaction is required beyond rendering the chart. The injected properties are inert until other code on the page reads them, so consequences depend on the consuming application. Workarounds Drop-in fix - for any versions affected (6.1.0-13.0.2). Add the below IIFE to run after Highcharts is loaded. ```javascript ((H)=>{const X = H.isObject;H.Point.prototype.setNestedProperty = function setNestedProperty(t,e,i){let s=i.split(".");return s.some(t=>"__proto__"===t||"constructor"===t)||s.reduce(function(t,i,s,o){let r=o.length-1===s;return t[i]=r?e:X(t[i],!0)?t[i]:{},t[i]},t),t};})(Highcharts); ``` Live demo & testing Obtaining the patched version The patched releases are available from all the usual distribution channels. With npm, upgrade the affected package to the patched version listed above, for example `npm install [email protected]`. If you load Highcharts from the CDN, use the versioned URLs on code.highcharts.com, for example `https://code.highcharts.com/13.1.1/highcharts.js`. For more on each installation method, see the installation guide.