CVE-2026-94402
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
- Score
- CVSS 3.1 6.1 Medium
- Status
- Awaiting Analysis - psirt@us.ibm.com
- Published
- 2026-10-20
- Last modified
- 2026-10-26
- Weaknesses
- CWE-79
Affected products
- Carbon Charts (Ibm)
- Carboncharts Angular (Ibm)
- Carboncharts React (Ibm)
- Carboncharts Svelte (Ibm)
- Carboncharts Vue (Ibm)
References
- https://www.ibm.com/support/pages/node/7291785
