CVE-2026-94402
Awaiting Analysis Awaiting Analysis - Queue

XSS in IBM Carbon Charts via MeterChart Title.truncateTitle

Publication date: 2026-10-20

Last updated on: 2026-10-26

Assigner: IBM Corporation

Description
IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-20
Last Modified
2026-10-26
Generated
2026-11-10
AI Q&A
2026-10-21
EPSS Evaluated
2026-11-08
NVD
CVE-2026-94402
EUVD
EUVD-2026-106856

Affected Vendors & Products

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

IBM Carbon Charts versions 0.4.0 through 1.27.19 have a cross-site scripting (XSS) vulnerability in the MeterChart component. The Title.truncateTitle() function inserts unsanitized user-supplied label text into the DOM using innerHTML when the title exceeds the container width. This allows a remote attacker to execute arbitrary JavaScript in a victim's browser session.

Detection Guidance

This vulnerability is specific to the MeterChart component in IBM Carbon Charts versions 0.4.0 through 1.27.19. Detection requires checking for the presence of these versions in your applications. Inspect package.json files for dependencies like @carbon/charts, @carbon/charts-react, or similar. No direct network commands can detect this as it is a client-side DOM manipulation issue.

Impact Analysis

This vulnerability could allow an attacker to run malicious scripts in your browser when you view a page using a vulnerable version of IBM Carbon Charts. This may lead to theft of session cookies, account takeover, or unauthorized actions on your behalf without your knowledge.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles and HIPAA's safeguards for protected health information. Organizations using vulnerable versions may face compliance violations and potential fines.

Mitigation Strategies

Upgrade IBM Carbon Charts to a version beyond 1.27.19 where this issue is fixed. If upgrading is not immediately possible, review all MeterChart components in your application to ensure user-supplied labels are sanitized before rendering. Avoid using innerHTML for dynamic content.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-94402. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...