PT-2026-120136 · Ibm · @Carbon/Charts+4
CVE-2026-94402
·
Published
2026-10-20
·
Updated
2026-10-20
CVSS v3.1
6.1
Medium
| Vector | AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
Fix
XSS
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
@Carbon/Charts
@Carbon/Charts-Angular
@Carbon/Charts-React
@Carbon/Charts-Svelte
@Carbon/Charts-Vue