{"id":"CVE-2026-120988","title":"billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.","summary":"billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.","severity":"medium","cvss":6.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","cvssSource":"adp","cwe":["CWE-79"],"vendor":"NAVER","product":"billboard.js","affected":["billboard.js (all versions)"],"ssvc":{"exploitation":"poc","automatable":"no","technicalImpact":"partial","timestamp":"2026-11-03T20:04:07.678691Z"},"exploitAvailable":true,"published":"2026-11-03","updated":"2026-11-03","sourceUpdated":"2026-11-03T20:05:01.896Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-120988","references":[{"url":"https://cve.naver.com/detail/cve-2026-120988.html"},{"url":"https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp"}],"tags":["cve.org","exploit-available"],"epss":0.00155,"epssPercentile":0.04614,"ingestedAt":"2026-11-05T20:33:06.429Z","slug":"CVE-2026-120988","body":"## Overview\n\nbillboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.\n\n## Affected\n\n- `billboard.js (all versions)`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"twilight","depthScore":46,"depthScoreParts":{"impact":33.6,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}