billboard.js CVE-2026-120988

Exploitation requires a non-default billboard.js configuration: the custom HTML legend must be enabled with both legend.contents.bindto and legend.contents.template set, and the template must leave an HTML tag open after the {=TITLE} placeholder. The series ids or names must originate from untrusted or third-party data controlled or influenced by the attacker. The flaw works because sanitize() in src/module/sanitize.ts rewrites only complete <...> matches, so a trailing unterminated tag in one series id passes through unchanged and is completed by the '>' in the next id after the per-item sanitized fragments are concatenated and written via wrapper.html() without re-sanitizing the joined string. Limiting factors: the attack needs victim UI:R (the user must load/view the chart page), it affects only applications that both feed untrusted data into series identifiers and use the custom legend template; tooltip and tableview are not affected because they sanitize the whole string. Charts using default legends or trusted-only series data are not exposed.

This is a moderate-severity DOM-based XSS (CWE-79, CVSS 6.1) whose real-world risk is tightly bounded by its exploitation preconditions rather than by the network attack vector alone. The CVSS vector (AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N) signals a network-reachable, low-complexity flaw with no attacker privileges but required user interaction (the victim must load the page) and a scope change into the DOM/browser context. All corroborating signals point to low urgency, not a drop-everything priority: EPSS is 0.16% (5th percentile), there is no CISA KEV listing (not actively exploited), and the vuln.today decision label is 'this_month' rather than act_now or emergency. Critically, this is NOT a flaw in default configurations - the GHSA advisory states exploitation requires the non-default custom HTML legend feature (legend.contents.bindto and legend.contents.template) AND untrusted data flowing into series ids/names AND a template that leaves a tag open after {=TITLE}. It is therefore a developer-dependent sink, not a universally exploitable endpoint, which is why the low EPSS is consistent with the medium CVSS: most billboard.js deployments do not use this configuration at all. The one signal that raises attention above the EPSS floor is that a concrete PoC appears in the vendor's own GHSA advisory and the issue is a confirmed bypass of the prior fix for CVE-2026-1513.

A web application uses billboard.js with a custom HTML legend (legend.contents.template) and renders chart series ids or names drawn from user-supplied or third-party data. An attacker supplies two crafted series ids that each individually survive sanitization but, once concatenated by the legend renderer, reconstruct a live element such as <img src=x onerror=...>, executing attacker JavaScript in the victim's browser when the chart is viewed. A working PoC demonstrating exactly this split-tag bypass is published in the vendor's GHSA advisory.