billboard.js is vulnerable to XSS during chart option binding

Description

billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.

Recommendation

Update the billboard.js package to the latest compatible version. Followings are version details:

Affected version(s): < 3.18.0
Patched version(s): 3.18.0

References

GHSA-rpc5-pm7q-hjmp
cve.naver.com
CVE-2026-1513
CWE-79
CAPEC-310
OWASP 2021-A3
OWASP 2021-A6

Could your website be exposed too?

SmartScanner can check your website for billboard.js is vulnerable to XSS during chart option binding and gives you actionable findings to investigate.

Start a free scan

Related Issues

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` - CVE-2026-27901
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
Trix is vulnerable to XSS through JSON deserialization bypass in drag-and-drop (Level0InputController) - CVE-2026-73427
wetty vulnerable to DOM XSS via file-download filename - CVE-2026-49864

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated January 28, 2026