CVE-2026-120988

UNKNOWN 0.0

CVSS Score

0.0

EPSS Score

0.0%

EPSS Percentile

0th

billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.

CWE	CWE-79
Vendor	naver
Product	billboard.js
Published	Nov 3, 2026

Stay Ahead of the Next One

Get instant alerts for naver billboard.js

Be the first to know when new unknown vulnerabilities affecting naver billboard.js are published — delivered to Slack, Telegram or Discord.

Get Free Alerts → Free · No credit card · 60 sec setup

Affected Versions

NAVER / billboard.js

All versions affected

References

NVD ↗ CVE.org ↗ EPSS Data ↗

cve.naver.com: https://cve.naver.com/detail/cve-2026-120988.html github.com: https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp

Credits

Zachariah Mithani (AploSec)