Description
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
Published: 2026-10-20
Score: 6.1 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Apply Patch
AI Analysis

Impact

IBM Carbon Charts 0.4.0 through 1.27.19 contains a cross‑site scripting flaw where the MeterChart component’s Title.truncateTitle() method inserts a slice of user‑supplied label text into the DOM using unsanitized innerHTML when a title exceeds the container width, allowing a remote attacker to embed malicious JavaScript that runs in the victim’s browser session.

Affected Systems

The flaw applies to the IBM Carbon Charts libraries for Angular, React, Svelte, and Vue (packages @carbon/charts, @carbon/charts-angular, @carbon/charts-react, @carbon/charts-svelte, @carbon/charts-vue), with all versions up to 1.27.19 (including the 0.4.0 series) vulnerable.

Risk and Exploitability

The CVSS score is 6.1, indicating medium severity; EPSS data is not available and the vulnerability is not listed in the CISA KEV catalog. An attacker can exploit it by supplying a malicious label in a chart configuration, causing the unsanitized truncation to inject and execute arbitrary JavaScript in the client’s browser context.

Generated by OpenCVE AI on October 21, 2026 at 11:38 UTC.

Remediation

Vendor Solution

Please update the library to the latest version available on npm:  https://www.npmjs.com/package/@carbon/charts

Vendor Workaround

If an immediate upgrade to v1.27.20 is not possible, consuming applications should sanitize all user-influenced strings before passing them as data[0].group (or any label field) to a MeterChart. A DOMPurify call with ALLOWED_TAGS: [] applied to the value before it reaches the chart data will neutralize the payload. This is a temporary workaround only — upgrading to v1.27.20 remains the recommended remediation.

OpenCVE Recommended Actions

  • Upgrade all affected IBM Carbon Charts packages to the latest version (v1.27.20 or newer) available on npm.
  • If an immediate upgrade is not feasible, sanitize all user‑supplied label strings before passing them to data[0].group or any label field in a MeterChart, using DOMPurify with ALLOWED_TAGS set to an empty array to neutralize the payload.
  • Apply a strong Content Security Policy that blocks inline script execution within the charting components to mitigate potential accidental exploitation.

Generated by OpenCVE AI on October 21, 2026 at 11:38 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 26 Oct 2026 17:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Tue, 20 Oct 2026 21:45:00 +0000

Type Values Removed Values Added
Description IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
Title IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
First Time appeared Ibm
Ibm carbon Charts
Ibm carboncharts Angular
Ibm carboncharts React
Ibm carboncharts Svelte
Ibm carboncharts Vue
Weaknesses CWE-79
CPEs cpe:2.3:a:ibm:carbon_charts:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carbon_charts:1.27.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_angular:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_angular:1.27.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_react:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_react:1.27.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_svelte:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_svelte:1.27.19:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_vue:0.4.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:carboncharts_vue:1.27.19:*:*:*:*:*:*:*
Vendors & Products Ibm
Ibm carbon Charts
Ibm carboncharts Angular
Ibm carboncharts React
Ibm carboncharts Svelte
Ibm carboncharts Vue
References
Metrics cvssV3_1

{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Ibm Carbon Charts Carboncharts Angular Carboncharts React Carboncharts Svelte Carboncharts Vue
cve-icon MITRE

Status: PUBLISHED

Assigner: ibm

Published:

Updated: 2026-10-26T16:46:47.189Z

Reserved: 2026-09-21T13:43:42.740Z

Link: CVE-2026-94402

cve-icon Vulnrichment

Updated: 2026-10-26T16:41:46.687Z

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-10-20T22:21:07.863

Modified: 2026-10-26T17:17:31.450

Link: CVE-2026-94402

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-21T18:45:06Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')