6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-1513

CVE-2026-1513: billboard.js is vulnerable to XSS during chart option binding

billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-1513

CVE-2026-1513:

6.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
billboard.js	npm	< 3.18.0	3.18.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability is a cross-site scripting (XSS) issue in billboard.js caused by improper input sanitization. The root cause was a weak sanitize function in src/module/util.ts. This function used a simple blacklist approach that was easily bypassed with encoded characters, nested tags, and other obfuscation techniques.

The vulnerability could be triggered by passing malicious strings in various chart configuration options. The provided patch highlights the point_pattern option as a key attack vector. The functions getGeneratePoint (in src/ChartInternal/shape/point.common.ts) and updateLegend (in src/ChartInternal/internals/legend.ts) directly used this user-controllable option to generate SVG and HTML for the chart, trusting the weak sanitize function to prevent XSS.

The fix was two-fold:

The sanitize function was completely rewritten to be much more robust. It now handles encoded payloads, control characters, and various attack patterns by decoding the input before applying filters in a loop.
The functions that consume potentially malicious options, like getGeneratePoint and updateLegend, were modified to use a new getValidPointPattern helper function. This adds a layer of defense by validating the point_pattern before it is used, rather than relying solely on the global sanitize function.

Vulnerable functions

sanitize

src/module/util.ts

The original `sanitize` function used a weak blacklist-based approach to remove dangerous HTML tags and attributes. This could be bypassed using various XSS techniques such as HTML entity encoding, control characters, and nested tags. The patch completely rewrites this function to implement a more robust, multi-step sanitization process that includes decoding entities before filtering, effectively neutralizing a wide range of XSS attack vectors.

getGeneratePoint

src/ChartInternal/shape/point.common.ts

This function generates chart data points and was vulnerable because it directly used the `point_pattern` value from the chart configuration. An attacker could supply a malicious payload in this option, which the old `sanitize` function would fail to clean properly. The patch mitigates this by replacing the direct use of `config.point_pattern` with a call to the newly introduced `getValidPointPattern` function, which performs strict validation.

updateLegend

src/ChartInternal/internals/legend.ts

The `updateLegend` function was vulnerable when rendering legend items that use points. Similar to `getGeneratePoint`, it directly consumed the `point_pattern` from the chart configuration. A malicious pattern could lead to XSS when the legend is rendered. The fix replaces the unsafe use of `config.point_pattern` with a call to the validating `getValidPointPattern` function.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.