high7.1
CVE-2026-1513
billboard.js is vulnerable to XSS during chart option binding
Impact
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| npm | billboard.js | < 3.18.0 | 3.18.0 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Naver | Billboard.Js | before 3.18.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://cve.naver.com/detail/cve-2026-1513.html
- https://github.com/advisories/GHSA-rpc5-pm7q-hjmp
- https://nvd.nist.gov/vuln/detail/CVE-2026-1513
- https://github.com/naver/billboard.js/issues/4078
- https://github.com/naver/billboard.js/commit/49e079cdd466fc8ba7ab208988181e5b7a5f336b