IBM Carbon Charts 0.4.01.27.19 MeterChart XSS via Title.truncateTitle
CVE-2026-94402 Published on October 20, 2026
IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
Vulnerability Analysis
CVE-2026-94402 is exploitable with network access, requires user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have a small impact on confidentiality and integrity, and no impact on availability.
Weakness Type
What is a XSS Vulnerability?
The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.
CVE-2026-94402 has been classified to as a XSS vulnerability or weakness.
Products Associated with CVE-2026-94402
Want to know whenever a new CVE is published for IBM products? stack.watch will email you.
Affected Versions
IBM @carbon/charts:- Version 0.4.0, <= 1.27.19 is affected.
- Version 0.4.0, <= 1.27.19 is affected.
- Version 0.4.0, <= 1.27.19 is affected.
- Version 0.4.0, <= 1.27.19 is affected.
- Version 0.4.0, <= 1.27.19 is affected.