Billboard.js, a JavaScript charting library, contains a cross‑site scripting flaw that allows an attacker to inject malicious code during legend template rendering. The flaw arises because series identifiers are incorporated into the template without proper sanitization. When an attacker supplies a crafted series id, the library inadvertently evaluates the id as script, enabling execution of arbitrary JavaScript in the victim’s browser, which can lead to data theft, session hijacking, or full page takeover.

The vulnerability affects any deployment of Naver’s billboard.js library that uses a version earlier than 4.1.3. Any web application that loads the library and allows user‑supplied series ids into the legend will be potentially impacted.

The vulnerability is a client‑side XSS that can be triggered by an attacker who can control the series ids. The EPSS score is not available, and the vulnerability is not listed in CISA KEV, but the absence of a public CVSS score suggests that the severity assessment is unclear. Nonetheless, the potential to execute arbitrary script in the user’s browser is high, so the risk is significant. An attacker can exploit the flaw by embedding script payloads into series ids that are rendered in the legend, and, if the page has privileged JavaScript or session cookies, can hijack sessions or perform malicious actions.