Skip to content
OpenAdvisories

Product · IBM

@carbon/charts-react

1 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 6.1
    CVE-2026-94402

    IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation

    IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds …

    IBM @carbon/charts @carbon/charts-react @carbon/charts-vue