What is GHSA-rpc5-pm7q-hjmp?

GHSA-rpc5-pm7q-hjmp is a security advisory published by GitHub Security Advisories with High severity. billboard.js is vulnerable to XSS during chart option binding

Which CVE IDs does GHSA-rpc5-pm7q-hjmp cover?

GHSA-rpc5-pm7q-hjmp covers the following CVE IDs: CVE-2026-1513. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rpc5-pm7q-hjmp?

GHSA-rpc5-pm7q-hjmp has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

Which products are affected by GHSA-rpc5-pm7q-hjmp?

GHSA-rpc5-pm7q-hjmp affects 1 product, including: npm/billboard.js:\u003c 3.18.0.

GHSA-rpc5-pm7q-hjmpHighCVSS 7.1

billboard.js is vulnerable to XSS during chart option binding

Vendor

GitHub Security Advisories

Published

January 28, 2026

Last Modified

January 28, 2026

🔗 CVE IDs covered (1)

CVE-2026-1513 →

📋 Description

billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.

🎯 Affected products1

npm/billboard.js:< 3.18.0

🔗 References (5)

https://nvd.nist.gov/vuln/detail/CVE-2026-1513
https://cve.naver.com/detail/cve-2026-1513.html
https://github.com/naver/billboard.js/issues/4078
https://github.com/naver/billboard.js/commit/49e079cdd466fc8ba7ab208988181e5b7a5f336b
https://github.com/advisories/GHSA-rpc5-pm7q-hjmp