billboard.js is vulnerable to XSS during chart option binding

Description

billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.

Recommendation

Update the billboard.js package to the latest compatible version. Followings are version details:

Affected version(s): < 3.18.0
Patched version(s): 3.18.0

References

GHSA-rpc5-pm7q-hjmp
cve.naver.com
CVE-2026-1513
CWE-79
CAPEC-310

Could your website be exposed too?

SmartScanner can check your website for billboard.js is vulnerable to XSS during chart option binding and gives you actionable findings to investigate.

Start a free scan

Related Issues

Svelte vulnerable to XSS during SSR with contenteditable `bind:innerText` and `bind:textContent` - CVE-2026-27901
Nuxt OG Image is vulnerable to reflected XSS via query parameter injection into HTML attributes - CVE-2026-34405
Svelte Vulnerable to XSS via DOM Clobbering of Internal Framework State - CVE-2026-42573
defuddle vulnerable to XSS via unescaped string interpolation in _findContentBySchemaText image tag - CVE-2026-30830

How to Secure your NodeJs Express Javascript Application - part 1

How do hackers hack websites?

CSRF, XXE, and 12 Other Security Acronyms Explained

See something that needs correcting? Let us knowUpdated January 28, 2026