Live › vulnerability › CVE-2026-94402
Go to dashboardIBM Carbon Charts versions 0.4.0 through 1.27.19 insert user-supplied label text into the page through innerHTML without sanitizing it when a MeterChart title is too wide for its container. An attacker who gets such a label into a chart can run JavaScript in the browser session of anyone who views it.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Applications that render MeterChart from the Carbon Charts library with titles or labels that contain user-supplied text are exposed. Teams that only use static, developer-written chart labels, or do not use MeterChart, can skip it.
No product ranges from the sources yet.
@carbon/charts or @carbon/charts-react version in package.json and the lockfile; affected range is 0.4.0 through 1.27.19.MeterChart usage where the title or labels come from user input.@carbon/charts past 1.27.19 (fixed version unknown from the sources; check the IBM advisory).Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.
This page as .md · .json · in your agent: get_signal("CVE-2026-94402")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.