JavaScript Execution Vulnerability in Billboard.js by Naver
CVE-2026-120988

Currently unrated

Key Information:

Vendor

Naver

Status
Billboard.js
Vendor
CVE Published:
3 November 2026

What is CVE-2026-120988?

Billboard.js, a versatile charting library developed by Naver, is susceptible to a vulnerability that allows attackers to execute malicious JavaScript. This issue arises from the library's improper sanitization of series IDs during the rendering of legend templates. Consequently, it opens up pathways for cross-site scripting (XSS) attacks, potentially compromising user data and application integrity. Users are advised to update to Billboard.js version 4.1.3 or later to mitigate this risk.

Affected Version(s)

billboard.js 4.1.3

References

https://cve.naver.com/detail/cve-2026-120988.html
vendor-advisory
https://github.com/naver/billboard.js/security/advisories...

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Zachariah Mithani (AploSec)
.