Description
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
Published: 2026-10-20
Score: 6.1 Medium
EPSS: n/a
KEV: No
Impact: n/a
Action: n/a
AI Analysis

No analysis available yet.

Remediation

Vendor Solution

Please update the library to the latest version available on npm:  https://www.npmjs.com/package/@carbon/charts

Vendor Workaround

If an immediate upgrade to v1.27.20 is not possible, consuming applications should sanitize all user-influenced strings before passing them as data[0].group (or any label field) to a MeterChart. A DOMPurify call with ALLOWED_TAGS: [] applied to the value before it reaches the chart data will neutralize the payload. This is a temporary workaround only — upgrading to v1.27.20 remains the recommended remediation.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
Title IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
First Time appeared Ibm
Ibm carbon Charts
Ibm carboncharts Angular
Ibm carboncharts React
Ibm carboncharts Svelte
Ibm carboncharts Vue
Weaknesses CWE-79
CPEs cpe:2.3:a:ibm:carbon_charts:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carbon_charts:1.27.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_angular:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_angular:1.27.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_react:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_react:1.27.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_svelte:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_svelte:1.27.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_vue:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_vue:1.27.19:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm carbon Charts
Ibm carboncharts Angular
Ibm carboncharts React
Ibm carboncharts Svelte
Ibm carboncharts Vue
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Ibm Carbon Charts Carboncharts Angular Carboncharts React Carboncharts Svelte Carboncharts Vue
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-20T21:31:46.027Z

Reserved: 2026-09-21T13:43:42.740Z

Link: CVE-2026-94402

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Received

Published: 2026-10-20T22:21:07.863

Modified: 2026-10-20T22:21:07.863

Link: CVE-2026-94402

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

No data.

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')