GitHub Advisoryadvisory · npm
GHSA-65p9-j6pg-72hj billboard.js allows prototype pollution via the function generate
CRITICAL
Official page ↗
- Aliases
- CVE-2025-49223
- Ecosystem
- npm
- Packages
- billboard.js
- Severity
- Critical
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-1321
- Reviewed
- 2025-07-29
Affected packages
• npm billboard.js: < 3.15.1 → fixed in 3.15.1
Description
billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to execute arbitrary code or cause a Denial of Service (DoS) via injecting arbitrary properties.
Related
Alias · CVE (1)
- CVE-2025-49223 billboard.js before 3.15.1 was discovered to contain a prototype pollution via the function generate, which could allow attackers to… vulnerability
Weakness · CWE (1)
- CWE-1321 Improperly Controlled Modification of Object Prototype Attributes weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2025-49223 advisory
- https://github.com/naver/billboard.js/commit/82ea7ac4f5720d6a7f0c2fa5a5dad51a549667bb web
- https://cve.naver.com/detail/cve-2025-49223.html web
- https://github.com/louay-075/CVE-2025-49223-BillboardJS-PoC web
- https://github.com/naver/billboard.js package
- https://github.com/naver/billboard.js/blob/938f263feca453fba5a4dc48d86b32cc5b509443/src/core.ts#L95 web