IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
"}],"value":"IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session."}],"metrics":[{"cvssV3_1":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":6.1,"baseSeverity":"MEDIUM","confidentialityImpact":"LOW","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"CHANGED","userInteraction":"REQUIRED","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","version":"3.1"},"format":"CVSS","scenarios":[{"lang":"en","value":"GENERAL"}]}],"problemTypes":[{"descriptions":[{"cweId":"CWE-79","description":"CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')","lang":"en","type":"CWE"}]}],"providerMetadata":{"dateUpdated":"2026-10-20T21:31:46.027Z","orgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","shortName":"ibm"},"references":[{"tags":["vendor-advisory","patch"],"url":"https://www.ibm.com/support/pages/node/7291785"}],"solutions":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"Please update the library to the latest version available on npm: https://www.npmjs.com/package/@carbon/charts
"}],"value":"Please update the library to the latest version available on npm: https://www.npmjs.com/package/@carbon/charts"}],"title":"IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation","workarounds":[{"lang":"en","supportingMedia":[{"base64":false,"type":"text/html","value":"If an immediate upgrade to v1.27.20 is not possible, consuming applications should sanitize all user-influenced strings before passing them as data[0].group (or any label field) to a MeterChart. A DOMPurify call with ALLOWED_TAGS: [] applied to the value before it reaches the chart data will neutralize the payload. This is a temporary workaround only — upgrading to v1.27.20 remains the recommended remediation.
"}],"value":"If an immediate upgrade to v1.27.20 is not possible, consuming applications should sanitize all user-influenced strings before passing them as data[0].group (or any label field) to a MeterChart. A DOMPurify call with ALLOWED_TAGS: [] applied to the value before it reaches the chart data will neutralize the payload. This is a temporary workaround only — upgrading to v1.27.20 remains the recommended remediation."}]}},"cveMetadata":{"assignerOrgId":"9a959283-ebb5-44b6-b705-dcc2bbced522","assignerShortName":"ibm","cveId":"CVE-2026-94402","datePublished":"2026-10-20T21:31:46.027Z","dateReserved":"2026-09-21T13:43:42.740Z","dateUpdated":"2026-10-20T21:31:46.027Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.2"},"nvd":{"publishedDate":"2026-10-20 22:21:07","lastModifiedDate":"2026-10-21 14:27:54","problem_types":["CWE-79","CWE-79 CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')"],"metrics":{"cvssMetricV31":[{"source":"psirt@us.ibm.com","type":"Primary","cvssData":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","baseScore":6.1,"baseSeverity":"MEDIUM","attackVector":"NETWORK","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"CHANGED","confidentialityImpact":"LOW","integrityImpact":"LOW","availabilityImpact":"NONE"},"exploitabilityScore":2.8,"impactScore":2.7}]},"configurations":[]},"legacy_mitre":{"record":{"CveYear":"2026","CveId":"94402","Ordinal":"1","Title":"IBM vulnerable to cross-site scripting (XSS) via unsanitized tit","CVE":"CVE-2026-94402","Year":"2026"},"notes":[{"CveYear":"2026","CveId":"94402","Ordinal":"1","NoteData":"IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.","Type":"Description","Title":"IBM vulnerable to cross-site scripting (XSS) via unsanitized tit"}]}}}