@carbon/charts vulnerabilities

CVEs whose affected-version data names the @carbon/charts package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.

1 CVERSS

CVE-2026-94402Medium· 6.1

yesterday

IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write w…

▾ SunlitIBM · @carbon/chartsvia CVEORG