{"id":"CVE-2026-120988","kind":"vulnerability","aliases":["CVE-2026-120988"],"related":[],"title":"billboard.js: unsanitized series ids let attackers run JavaScript in the page","description":"billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.","summary":"billboard.js is a JavaScript charting library; before version 4.1.3 it does not sanitize series ids when rendering the legend template. An attacker who controls a series id can make the browser run malicious JavaScript.","severity":"medium","cvss":null,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["billboard.js","front-end","javascript","package","web"],"not_affected_if":["no-billboard-js","static-series-names"],"how_to_check":"- Check the installed version with `npm ls billboard.js` in the project.\n- Search the front-end code and lockfile for `billboard.js` to find pages that render chart data from user-controlled input.","fix":"- billboard.js: upgrade to `4.1.3` or later.","status":"open","published_at":"2026-11-03T08:17:15+00:00","first_seen_at":"2026-11-03T08:19:30+00:00","triaged_at":"2026-11-03T08:19:42+00:00","updated_at":"2026-11-03T08:19:42+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-03T08:19:42Z","model":"claude-haiku-5-5","output":{"fix":"- billboard.js: upgrade to `4.1.3` or later.","reach":"unknown","title":"billboard.js: unsanitized series ids let attackers run JavaScript in the page","impact":"medium","summary":"billboard.js is a JavaScript charting library; before version 4.1.3 it does not sanitize series ids when rendering the legend template. An attacker who controls a series id can make the browser run malicious JavaScript.","audience":"developers","category":"package","nicknames":[],"who_cares":["javascript","billboard.js","front-end","web"],"confidence":0.6,"fix_status":"available","needs_auth":"unknown","worst_case":"malicious JavaScript runs in victims' browsers on the affected page","analyst_note":"Check the GitHub advisory linked from the sources for the exact trigger, whether user interaction is needed, and the affected version range.","how_to_check":"- Check the installed version with `npm ls billboard.js` in the project.\n- Search the front-end code and lockfile for `billboard.js` to find pages that render chart data from user-controlled input.","plain_action":"","needs_analyst":true,"not_affected_if":["no-billboard-js","static-series-names"],"who_is_affected":"Applications that use billboard.js to draw charts whose series ids come from user input or untrusted data are exposed. Charts built only from fixed, developer-controlled series names are unlikely to be reachable by an attacker. Projects that do not depend on billboard.js can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000682,"input_tokens":4086,"output_tokens":547,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-120988':14A,17A '-2026':13A,16A '4.1.3':33B,61C 'allow':62C 'attack':6A,46B,64C 'billboard.js':1A,18B,25B,59C 'browser':55B 'chart':29B 'control':48B 'cve':12A,15A 'due':69C 'end':21B 'execut':66C 'front':20B 'front-end':19B 'id':4A,39B,51B,75C 'improp':71C 'javascript':8A,22B,28B,58B,68C 'legend':43B,77C 'let':5A 'librari':30B 'make':53B 'malici':57B,67C 'packag':23B 'page':11A 'render':41B,79C 'run':7A,56B 'sanit':37B,72C 'seri':3A,38B,50B,74C 'templat':44B,78C 'unsanit':2A 'version':32B 'web':24B","nicknames":[],"mitigations":[],"who_affected":"Applications that use billboard.js to draw charts whose series ids come from user input or untrusted data are exposed. Charts built only from fixed, developer-controlled series names are unlikely to be reachable by an attacker. Projects that do not depend on billboard.js can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["billboardjs","frontend","javascript","medium","package","web"],"first_public_at":"2026-10-16T03:05:09+00:00","kev":null,"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-120988","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-120988","severity":null,"published_at":"2026-11-03T08:17:15+00:00","modified_at":"2026-11-03T08:17:15+00:00","first_seen_at":"2026-11-03T08:19:30+00:00","fetched_at":"2026-11-03T08:19:30+00:00","note":null}],"documents":[{"id":56474,"url":"https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp","title":"Vendor advisory: github.com","kind":"vendor","source":"nvd","publisher":"vendor","text":null,"published_at":"2026-10-16T03:05:09+00:00","relation":"advisory","confidence":null,"note":"Vendor advisory: github.com"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}