{"affected":[{"defaultStatus":"affected","product":"billboard.js","source":"CNA: naver","vendor":"NAVER","versions":[{"status":"unaffected","version":"4.1.3"}]}],"cveId":"CVE-2026-120988","cwes":["CWE-79"],"description":"billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.","epss":null,"exploits":[],"kev":null,"metrics":[],"modifiedAt":1793690135191,"publishedAt":1793690135191,"references":[{"source":"CNA: naver","tags":["vendor-advisory"],"url":"https://cve.naver.com/detail/cve-2026-120988.html"},{"source":"CNA: naver","tags":[],"url":"https://github.com/naver/billboard.js/security/advisories/GHSA-g5px-mcqp-3ghp"}],"remediation":[],"revision":"e8929d897b6700f3eaa7fe1dc1a8e52fd5a2d49515f14d8937a1a02ec1217941","sources":[{"modifiedAt":1793690135191,"name":"CNA: naver","retrievedAt":1793693301068,"url":"https://www.cve.org/CVERecord?id=CVE-2026-120988"}],"ssvc":null,"status":"published","title":"CVE-2026-120988","updatedAt":1793693301068}