Code execution via unsafe configuration merging

Prototype pollution in NAVER Corporation billboard.js before 3.15.1 allows remote attackers to execute code or crash applications. The generate function recursively merges attacker-controlled chart configuration keys into ordinary objects without rejecting proto, constructor, or prototype, allowing writes into Object.prototype. Exploitation requires an application to pass attacker-controlled configuration to generate; polluted properties then affect later objects in the same JavaScript runtime.