Cross-Site Scripting Vulnerability in IBM Carbon Charts

CVE-2026-94402

What is CVE-2026-94402?

The IBM Carbon Charts product, ranging from versions 0.4.0 to 1.27.19, contains a cross-site scripting vulnerability that arises from improper sanitization of user-supplied data in the MeterChart component. Specifically, the Title.truncateTitle() function allow re-insertion of unfiltered label text into the Document Object Model (DOM) during rendering, posing a risk of arbitrary JavaScript execution in the user's browser session. This vulnerability can be exploited by a remote attacker, potentially leading to a range of malicious activities. It is crucial for users and administrators to review the advisory and apply appropriate patches to mitigate this security risk.

References