{"id":"CVE-2026-94402","aliases":[],"title":"IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation","titleSource":"ibm","descriptionSource":"ibm","products":[{"vendor":"IBM","name":"@carbon/charts","platforms":[],"versions":[{"version":"0.4.0","status":"affected","lessThanOrEqual":"1.27.19","versionType":"semver"}],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-94402"},{"vendor":"IBM","name":"@carbon/charts-react","platforms":[],"versions":[{"version":"0.4.0","status":"affected","lessThanOrEqual":"1.27.19","versionType":"semver"}],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-94402"},{"vendor":"IBM","name":"@carbon/charts-angular","platforms":[],"versions":[{"version":"0.4.0","status":"affected","lessThanOrEqual":"1.27.19","versionType":"semver"}],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-94402"},{"vendor":"IBM","name":"@carbon/charts-vue","platforms":[],"versions":[{"version":"0.4.0","status":"affected","lessThanOrEqual":"1.27.19","versionType":"semver"}],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-94402"},{"vendor":"IBM","name":"@carbon/charts-svelte","platforms":[],"versions":[{"version":"0.4.0","status":"affected","lessThanOrEqual":"1.27.19","versionType":"semver"}],"source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-94402"}],"remediation":[{"text":"Please update the library to the latest version available on npm:  https://www.npmjs.com/package/@carbon/charts","source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-94402"},{"text":"If an immediate upgrade to v1.27.20 is not possible, consuming applications should sanitize all user-influenced strings before passing them as data[0].group (or any label field) to a MeterChart. A DOMPurify call with ALLOWED_TAGS: [] applied to the value before it reaches the chart data will neutralize the payload. This is a temporary workaround only — upgrading to v1.27.20 remains the recommended remediation.","source":"ibm","url":"https://www.cve.org/CVERecord?id=CVE-2026-94402"}],"description":"IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.","severity":"medium","score":6.1,"published":"2026-10-20T21:31:46.027Z","modified":"2026-10-26T16:46:47.189Z","withdrawn":false,"knownExploited":false,"affected":[],"references":["https://www.ibm.com/support/pages/node/7291785"],"sources":[{"name":"CVE","id":"CVE-2026-94402","modified":"2026-10-26T16:46:47.189Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-94402"}],"assessments":[{"source":"ibm","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","score":6.1}],"sourceAffected":[],"kev":{"status":"not-listed","checkedAt":"2026-10-29T03:10:35.950Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[]}