Live › vulnerability › CVE-2026-120988
billboard.js is a JavaScript charting library; before version 4.1.3 it does not sanitize series ids when rendering the legend template. An attacker who controls a series id can make the browser run malicious JavaScript.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-03 08:19 UTC. All times on this page are UTC.
Applications that use billboard.js to draw charts whose series ids come from user input or untrusted data are exposed. Charts built only from fixed, developer-controlled series names are unlikely to be reachable by an attacker. Projects that do not depend on billboard.js can skip it.
No product ranges from the sources yet.
npm ls billboard.js in the project.billboard.js to find pages that render chart data from user-controlled input.4.1.3 or later.Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.
This page as .md · .json · in your agent: get_signal("CVE-2026-120988")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.