CVE-2026-120988
Received Received - Intake

Cross-Site Scripting in billboard.js via Legend Template

Publication date: 2026-11-03

Last updated on: 2026-11-03

Assigner: Naver Corporation

Description
billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-03
Last Modified
2026-11-03
Generated
2026-11-03
AI Q&A
2026-11-03
EPSS Evaluated
N/A
NVD
CVE-2026-120988
EUVD
EUVD-2026-115726

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
naver billboard.js to 4.1.3 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2026-120988 is a Cross-Site Scripting (XSS) vulnerability in billboard.js versions prior to 4.1.3. It occurs when custom HTML legends are used and the sanitization of series IDs or names is bypassed. The issue allows attackers to execute malicious JavaScript by exploiting improper handling of unterminated HTML tags during legend rendering.

Detection Guidance

Check if your billboard.js version is below 4.1.3 by inspecting package.json or running npm list billboard.js. Look for custom HTML legends using untrusted data for series IDs or names. Manually test by injecting partial tags like <img src=x onerror=alert(1) into series names and observe if they execute.

Impact Analysis

This vulnerability can impact users by allowing attackers to inject and execute malicious JavaScript in web pages using billboard.js with custom legends. This could lead to data theft, session hijacking, or defacement of the affected page. Exploitation requires user interaction, such as visiting a crafted webpage.

Mitigation Strategies

Upgrade billboard.js to version 4.1.3 or later immediately. If upgrading is not possible, validate all untrusted input for series IDs or names before passing them to the chart. Avoid using custom HTML legends with untrusted data until patched.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-120988. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...