{"id":"CVE-2026-120988","published":"2026-11-03T08:17:15.070","lastModified":"2026-11-03T08:17:15.070","description":"billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.","cvssScore":null,"cvssSeverity":null,"cvssVector":null,"cwes":["CWE-79"],"vendors":[],"products":[],"references":[{"url":"https://cve.naver.com/detail/cve-2026-120988.html","tags":[]},{"url":"https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp","tags":[]}],"exploitRefs":[{"url":"https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp","tags":[]}],"hasPoc":true,"ai":null}