CVE-2026-1513
Medium · 6.1CVSS
6.1
EPSS
0.2%
Published
Jan 28, 2026
CISA due date
—
The record
billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| npm | billboard.js | 0 | 3.18.0 |
| openSUSE:Tumbleweed | cacti | 0 | 1.2.30+git231.bca15e70c-1.1 |
Related vulnerabilities
- GHSA-rpc5-pm7q-hjmp billboard.js is vulnerable to XSS during chart option binding Same vulnerability
- CVE-2026-0540 DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a… Also affects cacti
- CVE-2024-34340 Cacti provides an operational monitoring and fault management framework. Also affects cacti
- CVE-2024-31459 Cacti provides an operational monitoring and fault management framework. Also affects cacti
- CVE-2024-31460 Cacti provides an operational monitoring and fault management framework. Also affects cacti
- CVE-2024-31458 Cacti provides an operational monitoring and fault management framework. Also affects cacti
- CVE-2024-31444 Cacti provides an operational monitoring and fault management framework. Also affects cacti
- CVE-2024-29894 Cacti provides an operational monitoring and fault management framework. Also affects cacti