---
id: CVE-2026-94402
title: IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation
summary: >-
  IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting.
  The MeterChart component's Title.truncateTitle() function re-inserts a
  substring of user-supplied label text into the DOM via an unsanitized
  innerHTML write w…
severity: medium
cvss: 6.1
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'
cvssSource: cna
cwe:
  - CWE-79
vendor: IBM
product: '@carbon/charts'
affected:
  - '@carbon/charts >= 0.4.0 <= 1.27.19'
  - '@carbon/charts-react >= 0.4.0 <= 1.27.19'
  - '@carbon/charts-angular >= 0.4.0 <= 1.27.19'
  - '@carbon/charts-vue >= 0.4.0 <= 1.27.19'
  - '@carbon/charts-svelte >= 0.4.0 <= 1.27.19'
published: '2026-10-20'
updated: '2026-10-20'
sourceUpdated: '2026-10-20T21:31:46.027Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-94402'
references:
  - url: 'https://www.ibm.com/support/pages/node/7291785'
tags:
  - cve.org
ingestedAt: '2026-10-20T22:23:33.695Z'
---

## Overview

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

## Affected

- `@carbon/charts >= 0.4.0 <= 1.27.19`
- `@carbon/charts-react >= 0.4.0 <= 1.27.19`
- `@carbon/charts-angular >= 0.4.0 <= 1.27.19`
- `@carbon/charts-vue >= 0.4.0 <= 1.27.19`
- `@carbon/charts-svelte >= 0.4.0 <= 1.27.19`

## Remediation

Please update the library to the latest version available on npm:  https://www.npmjs.com/package/@carbon/charts

### Workarounds

If an immediate upgrade to v1.27.20 is not possible, consuming applications should sanitize all user-influenced strings before passing them as data[0].group (or any label field) to a MeterChart. A DOMPurify call with ALLOWED_TAGS: [] applied to the value before it reaches the chart data will neutralize the payload. This is a temporary workaround only — upgrading to v1.27.20 remains the recommended remediation.