billboard.js before 4.1.3 allows an attacker to execute malicious JavaScript due to improper sanitization of series ids during legend template rendering.
An attacker needs a way to supply or influence a series ID that is rendered through a legend template. Exploitation also requires a user to interact with the malicious content, as reflected by the UI:R attack vector.
Deployments using billboard.js versions before 4.1.3 are affected when they render attacker-controlled or otherwise untrusted series IDs in legend templates. The available data does not establish whether every default configuration renders such IDs.
Avoid passing untrusted data into series IDs used by legend templates, and validate or strictly constrain series IDs before rendering. This reduces the opportunity for malicious JavaScript to reach the vulnerable template rendering path.
Check whether your application uses billboard.js before version 4.1.3 and whether any user-controlled, externally sourced, or insufficiently validated values can become series IDs displayed in legend templates. An exploit proof of concept was published on 2026-11-03.