CVE-2016-1000240

Affected versions of "c3" are vulnerable to cross-site scripting via improper sanitization of HTML in rendered tooltips...