« Volver al listado

CVE-2026-1513

Estado: AnalizadaMedia (6.1)—

billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Naver — Billboard.js

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2026-1513",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-1513",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-01-28T14:46:29.933678Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "cve@navercorp.com",
      "affectedData": [
        {
          "vendor": "NAVER",
          "product": "billboard.js",
          "versions": [
            {
              "status": "unaffected",
              "version": "3.18.0"
            }
          ],
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-01-28T02:16:00.310",
  "references": [
    {
      "url": "https://cve.naver.com/detail/cve-2026-1513.html",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@navercorp.com"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@navercorp.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "billboard.js before 3.18.0 allows an attacker to execute malicious JavaScript due to improper sanitization during chart option binding."
    },
    {
      "lang": "es",
      "value": "billboard.js anterior a la versión 3.18.0 permite a un atacante ejecutar JavaScript malicioso debido a una sanitización incorrecta durante la vinculación de opciones de gráfico."
    }
  ],
  "lastModified": "2026-06-17T10:15:58.527",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:naver:billboard.js:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "37EE82A8-0A1B-4082-9C82-4653E6B987AE",
              "versionEndExcluding": "3.18.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@navercorp.com"
}