What is the CVSS score of CVE-2025-49223?

CVE-2025-49223 has a contested CVSS base score of 9.8 from a third party (e.g. CISA-ADP), while the vendor rates it Critical. vuln.today uses the vendor rating as authoritative.

Which versions of Billboard.Js are affected by CVE-2025-49223?

A critical vulnerability (CVE-2025-49223) in billboard.js enables remote attackers to execute arbitrary code or crash affected applications through prototype pollution attacks.. A patch is available.

How to fix or mitigate CVE-2025-49223?

Within 24 hours: Inventory all systems and applications using billboard.js and assess which are internet-facing or process untrusted input. Within 7 days: Implement network segmentation to restrict billboard.js application access, deploy WAF rules to detect/block prototype pollution payloads, and disable the vulnerable generate() function if functionally possible. Within 30 days: Evaluate alternative libraries, plan migration strategy, and monitor for official patch release from billboard.js project.

Billboard.Js CVE-2025-49223

EUVD-2025-16802 CRITICAL

Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution) (CWE-1321)

2025-06-04 cve@navercorp.com

GHSA-65p9-j6pg-72hj

RCE Denial Of Service Billboard.Js

Critical

Disputed · 9.8 NVD

Severity by source

Sources disagree (Medium–Critical)

NVD PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Ubuntu

MEDIUM

qualitative

vuln.today treats the vendor’s rating as authoritative. A higher third-party CVSS (e.g. CISA-ADP) is shown for transparency but does not drive the headline severity.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 14, 2026 - 17:29 euvd

EUVD-2025-16802

Analysis Generated

Mar 14, 2026 - 17:29 vuln.today

CVE Published

Jun 04, 2025 - 03:15 nvd

CRITICAL 9.8

DescriptionCVE.org

billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.

AnalysisAI

Prototype pollution in billboard.js before 3.15.1 via generate function.

Technical ContextAI

CWE-1321.

RemediationAI

Update.

More in Billboard.Js

View all

CVE-2026-1513 MEDIUM This Month

6.1 Jan 28

Cross-site scripting (XSS) in Billboard.js versions before 3.18.0 enables remote attackers to inject and execute arbitra

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

View all

CVE-2026-34621 HIGH POC

8.6

CVE-2024-56059 CRITICAL

9.8

CVE-2020-28271 CRITICAL POC

9.8

CVE-2023-38894 CRITICAL POC

9.8

CVE-2024-24292 CRITICAL POC

9.8

CVE-2023-26121 CRITICAL POC

10.0

CVE-2021-23449 CRITICAL POC

10.0

CVE-2024-39011 CRITICAL POC

9.8

Same technique RCE

View all

CVE-2017-7269 CRITICAL POC

9.8

CVE-2012-4681 CRITICAL POC

9.8

CVE-2015-5119 CRITICAL POC

9.8

CVE-2016-4117 CRITICAL POC

9.8

CVE-2015-3113 CRITICAL POC

9.8

CVE-2011-2462 CRITICAL POC

9.8

CVE-2025-53770 CRITICAL POC

9.8

CVE-2020-7961 CRITICAL POC

9.8

Vendor StatusVendor

Ubuntu

Priority: Medium

cacti

Release	Status	Version
trusty	needs-triage	-
xenial	needs-triage	-
bionic	needs-triage	-
focal	needs-triage	-
jammy	needs-triage	-
noble	needs-triage	-
upstream	needs-triage	-
oracular	ignored	end of life, was needs-triage
plucky	ignored	end of life, was needs-triage
questing	needs-triage	-

CVE-2025-49223 vulnerability details – vuln.today

Back

Billboard.Js CVE-2025-49223

Severity by source

CVSS VectorNVD

Lifecycle Timeline

DescriptionCVE.org

AnalysisAI

Technical ContextAI

RemediationAI

More in Billboard.Js

Same weakness CWE-1321 – Improperly Controlled Modification of Object Prototype Attributes (Prototype Pollution)

Same technique RCE

Vendor StatusVendor

Ubuntu

Share

External POC / Exploit Code