{"action":"Upgrade billboard.js to 3.18.0 or later.","affected":[{"fixed":"3.18.0","introduced":"0"}],"component":"billboard.js","cve_ids":["CVE-2026-1513"],"ecosystem":"npm","epss":0.00205,"exploited":false,"fixed_versions":["3.18.0"],"ghsa_id":"GHSA-rpc5-pm7q-hjmp","id":"tcs_01M5KG9H7RENVKH9H23Q2FGT9B","modified_at":"2026-02-03T03:05:53.734138Z","published_at":"2026-01-28T03:30:30Z","references":["https://osv.dev/vulnerability/GHSA-rpc5-pm7q-hjmp","https://nvd.nist.gov/vuln/detail/CVE-2026-1513","https://github.com/naver/billboard.js/issues/4078","https://github.com/naver/billboard.js/commit/49e079cdd466fc8ba7ab208988181e5b7a5f336b","https://cve.naver.com/detail/cve-2026-1513.html","https://github.com/naver/billboard.js"],"severity":{"label":"high","score":7.1},"sources":[{"source":"osv","source_id":"GHSA-rpc5-pm7q-hjmp","url":"https://osv.dev/vulnerability/GHSA-rpc5-pm7q-hjmp"}],"summary":"billboard.js is vulnerable to XSS during chart option binding"}