IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation

Overview

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

Affected

• @carbon/charts >= 0.4.0 <= 1.27.19
• @carbon/charts-react >= 0.4.0 <= 1.27.19
• @carbon/charts-angular >= 0.4.0 <= 1.27.19
• @carbon/charts-vue >= 0.4.0 <= 1.27.19
• @carbon/charts-svelte >= 0.4.0 <= 1.27.19

Remediation

Please update the library to the latest version available on npm:  https://www.npmjs.com/package/@carbon/charts

Workarounds

If an immediate upgrade to v1.27.20 is not possible, consuming applications should sanitize all user-influenced strings before passing them as data[0].group (or any label field) to a MeterChart. A DOMPurify call with ALLOWED_TAGS: [] applied to the value before it reaches the chart data will neutralize the payload. This is a temporary workaround only — upgrading to v1.27.20 remains the recommended remediation.