CVE-2026-1513
billboard.js is vulnerable to XSS during chart option binding
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
- Record
CVE-2026-1513- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2026-4915
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
- Record
EUVD-2026-4915- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-rpc5-pm7q-hjmp
billboard.js is vulnerable to XSS during chart option binding
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
- Record
GHSA-rpc5-pm7q-hjmp- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
NVD
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
- Record
CVE-2026-1513- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSV
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
- Record
CVE-2026-1513- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVGHSA-rpc5-pm7q-hjmp
billboard.js is vulnerable to XSS during chart option binding
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
- Record
GHSA-rpc5-pm7q-hjmp- CVSS 3.1
- 7.1 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10241-1 No score
cacti-1.2.30+git231.bca15e70c-1.1 on GA media
These are all security issues fixed in the cacti-1.2.30+git231.bca15e70c-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10241-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
billboard.jsnpm |
before 3.18.0 | 3.18.0 |
cactiopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 1.2.30+git231.bca15e70c-1.1 | 1.2.30+git231.bca15e70c-1.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-1513 is a medium vulnerability (CVSS 6.1) in Naver Billboard.js, published January 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.21%, the 10th percentile. Fixed in billboard.js 3.18.0.
References
cve.naver.com/detail/cve-2026-1513.html
nvd.nist.gov/vuln/detail/CVE-2026-1513
github.com/naver/billboard.js/issues/4078
suse.com/security/cve/CVE-2026-1513