From c1bccee780fc5d18243ed2fdab3b5e45718c3204 Mon Sep 17 00:00:00 2001
From: contactjawad <contact.jawaddd@gmail.com>
Date: Tue, 25 Aug 2026 11:38:31 +0500
Subject: [PATCH] fix(helpers): resolveObjectKey returns wrong value for
 Object.prototype keys

The resolver cache was a plain object literal, so it inherited from
Object.prototype. Keys matching prototype members (e.g. toString,
hasOwnProperty, valueOf) hit the inherited method instead of falling
through to build the correct resolver, yielding wrong output. Use a
null-prototype object for the cache.
---
 src/helpers/helpers.core.ts      | 15 ++++++++-------
 test/specs/helpers.core.tests.js |  6 ++++++
 2 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/src/helpers/helpers.core.ts b/src/helpers/helpers.core.ts
index 7203a92c2ce..1ad02fe9de1 100644
--- a/src/helpers/helpers.core.ts
+++ b/src/helpers/helpers.core.ts
@@ -333,13 +333,14 @@ export function _deprecated(scope: string, value: unknown, previous: string, cur
 }
 
 // resolveObjectKey resolver cache
-const keyResolvers = {
-  // Chart.helpers.core resolveObjectKey should resolve empty key to root object
-  '': v => v,
-  // default resolvers
-  x: o => o.x,
-  y: o => o.y
-};
+// Use a null-prototype object so keys colliding with Object.prototype members
+// (e.g. 'toString', 'hasOwnProperty', '__proto__') don't resolve to inherited values.
+const keyResolvers = Object.create(null);
+// Chart.helpers.core resolveObjectKey should resolve empty key to root object
+keyResolvers[''] = v => v;
+// default resolvers
+keyResolvers.x = o => o.x;
+keyResolvers.y = o => o.y;
 
 /**
  * @private
diff --git a/test/specs/helpers.core.tests.js b/test/specs/helpers.core.tests.js
index c5c51434c88..0edeeb0f3c1 100644
--- a/test/specs/helpers.core.tests.js
+++ b/test/specs/helpers.core.tests.js
@@ -471,6 +471,12 @@ describe('Chart.helpers.core', function() {
       }, 'a.bb\\.ccc')).toEqual('works');
     });
 
+    it('should resolve keys that collide with Object.prototype members', function() {
+      expect(helpers.resolveObjectKey({toString: 5}, 'toString')).toEqual(5);
+      expect(helpers.resolveObjectKey({hasOwnProperty: 42}, 'hasOwnProperty')).toEqual(42);
+      expect(helpers.resolveObjectKey({valueOf: 7}, 'valueOf')).toEqual(7);
+    });
+
   });
 
   describe('_splitKey', function() {