CVE-2026-94402 IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation

Medium 6.1 Published 20 Oct 2026 Updated 26 Oct 2026

Exploited in the wild: Not known
Fix: None listed

What is CVE-2026-94402?

CVE-2026-94402 is a medium-severity vulnerability in IBM @carbon/charts, published on 20 Oct 2026.

Official description

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle() function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session.

Weakness: CWE-79

Which versions are affected by CVE-2026-94402?

How do I fix CVE-2026-94402?

No fix has been published for CVE-2026-94402 yet. Limit exposure of the affected software until one is available.

Is CVE-2026-94402 being exploited?

There is no known exploitation of CVE-2026-94402 in the wild and no public exploit code.

Sources

Also known as GHSA-xgrw-h689-334j.