CVE-2026-120988 PUBLISHED

Assigner: naver
Reserved: 03.11.2026 Published: 03.11.2026 Updated: 03.11.2026

billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.

Product Status

Vendor NAVER
Product billboard.js
Versions Default: affected
  • Version 4.1.3 is unaffected

Credits

  • Zachariah Mithani (AploSec) finder

References

Problem Types

  • CWE-79 Improper neutralization of input during web page generation ('cross-site scripting') CWE