Description
billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Recommendation
Update the billboard.js package to the latest compatible version. Followings are version details:
- Affected version(s): < 3.15.1
- Patched version(s): 3.15.1
References
Could your website be exposed too?
SmartScanner can check your website for billboard.js allows prototype pollution via the function generate and gives you actionable findings to investigate.
Start a free scanRelated Issues
- tarteaucitron.js allows prototype pollution via custom text injection - CVE-2025-31475
- @ianwalter/merge Prototype Pollution via `merge` function - CVE-2021-23397
- Prototype pollution in ag-grid-community via the _.mergeDeep function - ag-grid-enterprise - CVE-2024-38996
- mockjs vulnerable to Prototype Pollution via the Util.extend function - CVE-2023-26158
You might also like:
See something that needs correcting? Let us knowUpdated July 29, 2025