CVE-2026-94402: IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation

Q: Which deployments are exposed?

Deployments using IBM Carbon Charts versions 0.4.0 through 1.27.19 may be exposed when they render a MeterChart whose title is derived from user-supplied label text. The affected packages listed are @carbon/charts and its React, Angular, Vue, and Svelte integrations.

Q: What conditions are required for exploitation?

An attacker must be able to influence label text used in a MeterChart title, and the title must exceed the available container width so that Title.truncateTitle() runs. The victim must then interact with the rendered content in a browser, where the unsanitized innerHTML write can execute JavaScript.

Q: How can I identify potentially affected instances?

Check whether your application uses an affected Carbon Charts package version in the stated range and renders MeterChart components. Prioritize cases where untrusted or externally supplied text can reach MeterChart title labels, especially in narrow containers or layouts that cause title truncation.

Published Oct 9, 2026

Updated

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

Other sources

IBM Carbon Charts is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

— IBM

Affected Software

5 affected components

IBM @carbon/charts<=0.4.0 - 1.27.19

IBM @carbon/charts-react<=0.4.0 - 1.27.19

IBM @carbon/charts-angular<=0.4.0 - 1.27.19

IBM @carbon/charts-vue<=0.4.0 - 1.27.19

IBM @carbon/charts-svelte<=0.4.0 - 1.27.19

Event History

Oct 20, 2026

CVE Published

via IBM·12:00 AM

Data Sourced

via IBM·12:00 AM

DescriptionAffected Software

CVE Published

via MITRE·09:31 PM

Data Sourced

via MITRE·09:31 PM

RemedyDescriptionSeverityWeakness

Parent advisories

This vulnerability appears in the following advisories.

IBM-7291785

Frequently Asked Questions

Which deployments are exposed?

Deployments using IBM Carbon Charts versions 0.4.0 through 1.27.19 may be exposed when they render a MeterChart whose title is derived from user-supplied label text. The affected packages listed are @carbon/charts and its React, Angular, Vue, and Svelte integrations.

What conditions are required for exploitation?

An attacker must be able to influence label text used in a MeterChart title, and the title must exceed the available container width so that Title.truncateTitle() runs. The victim must then interact with the rendered content in a browser, where the unsanitized innerHTML write can execute JavaScript.

How can I identify potentially affected instances?

Check whether your application uses an affected Carbon Charts package version in the stated range and renders MeterChart components. Prioritize cases where untrusted or externally supplied text can reach MeterChart title labels, especially in narrow containers or layouts that cause title truncation.

CVE-2026-94402: IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation

Other sources

Affected Software

Event History

Parent advisories

Frequently Asked Questions

Which deployments are exposed?

What conditions are required for exploitation?

How can I identify potentially affected instances?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What conditions are required for exploitation?

How can I identify potentially affected instances?