billboard.js is vulnerable to XSS during chart option binding

Description

billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.

Recommendation

Update the billboard.js package to the latest compatible version. Followings are version details:

• Affected version(s): < 3.18.0
• Patched version(s): 3.18.0

References

• GHSA-rpc5-pm7q-hjmp
• cve.naver.com
• CVE-2026-1513
• CWE-79
• CAPEC-310
• OWASP 2021-A3
• OWASP 2021-A6

Related Issues

• Maker.js has Unsafe Property Copying in makerjs.extendObject - CVE-2026-24888
• @digitalocean/do-markdownit has Type Confusion vulnerability - CVE-2025-59717
• Parse Server before v3.4.1 vulnerable to Denial of Service - CVE-2019-1020012
• useragent Regular Expression Denial of Service vulnerability - CVE-2020-26311

Tags:

npm

billboard.js