CVE-2026-120988

Description

billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.

References

https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp

https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-115726

https://cve.naver.com/detail/cve-2026-120988.html

Details

Source: Mitre, NVD

EPSS