EUVD-2026-106856

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote...

Security Bulletin: IBM @carbon/charts MeterChart vulnerable to cross-site scripting (XSS) via unsanitized title truncation (CVE-2026-94402)

Summary IBM @carbon/charts is vulnerable to cross-site scripting in the MeterChart component where Title.truncateTitle re-inserts user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width, allowing a remote attacker to execute...

CVE-2026-94402

IBM Carbon Charts 0.4.0 through 1.27.19 is vulnerable to cross-site scripting. The MeterChart component's Title.truncateTitle function re-inserts a substring of user-supplied label text into the DOM via an unsanitized innerHTML write when the title exceeds the available container width. A remote...

CVE-2026-94402

The IBM @carbon/charts library (including react , angular , vue , and svelte variants) is vulnerable to cross-site scripting (XSS) via unsanitized title truncation in the MeterChart component. The issue resides in the Title.truncateTitle() function, which performs an unsanitized innerHTML write o...

Security Bulletin: Resolved XSS vulnerability in DOMPurify (CVE-2026-75838)

Summary Carbon Charts has updated its DOMPurify dependency from ^3.4.12 to ^3.4.14, resolving CVE-2026-75838 Medium, CVSS 5.4 — an XSS vulnerability caused by improper INPLACE sanitization in DOMPurify versions prior to 3.4.13. The vulnerability affects the sanitize API used internally by Carbon...

Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)

Summary Carbon Charts has updated its DOMPurify dependency from 3.4.0 to 3.4.12, resolving 9 CVEs identified by security scanning CVE-2026-49978 Critical CVSS 9.3, CVE-2026-65898 High CVSS 7.2, CVE-2026-66010 Medium CVSS 6.1, CVE-2026-65902 Medium CVSS 6.1, CVE-2026-65901 Medium CVSS 6.1,...

Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)

Summary Carbon Charts has updated its DOMPurify dependency from 3.4.0 to 3.4.12, resolving 9 CVEs identified by security scanning CVE-2026-49978 Critical CVSS 9.3, CVE-2026-65898 High CVSS 7.2, CVE-2026-66010 Medium CVSS 6.1, CVE-2026-65902 Medium CVSS 6.1, CVE-2026-65901 Medium CVSS 6.1,...

Security Bulletin: Resolved multiple XSS vulnerabilities in DOMPurify (CVE-2026-49978, CVE-2026-65898, CVE-2026-66010, and others)

Summary Carbon Charts has updated its DOMPurify dependency from 3.4.0 to 3.4.12, resolving 9 CVEs identified by security scanning CVE-2026-49978 Critical CVSS 9.3, CVE-2026-65898 High CVSS 7.2, CVE-2026-66010 Medium CVSS 6.1, CVE-2026-65902 Medium CVSS 6.1, CVE-2026-65901 Medium CVSS 6.1,...

Security Bulletin: Carbon chart DOMPurify XSS Vulnerabilities (CVE-2026-41238, CVE-2026-41239, CVE-2026-41240)

Summary Three cross-site scripting XSS vulnerabilities CVE-2026-41238, CVE-2026-41239, and CVE-2026-41240 were identified in the DOMPurify library versions 3.0.1 through 3.3.3. These vulnerabilities allow attackers to bypass sanitization through prototype pollution exploitation, template expressi...

Security Bulletin: Carbon Charts React Router Security Vulnerabilities

Summary Carbon Charts versions prior to v1.27.8 include a vulnerable version of React Router that is susceptible to five security vulnerabilities CVE-2025-59057, CVE-2025-68470, CVE-2026-21884, CVE-2026-22029, CVE-2026-22030 with severity ranging from Medium to High CVSS 6.1 to 8.2. These...

Security Bulletin: Carbon Charts lodash-es Security Vulnerabilities

Summary Carbon Charts versions prior to 1.27.8 include lodash-es version 4.17.23, which contains two security vulnerabilities: a prototype pollution vulnerability CVE-2026-2950, CVSS 5.3 in the .unset and .omit functions that allows deletion of properties from built-in prototypes, and a critical...

CVE-2024-47117

IBM Carbon Design System Carbon Charts 0.4.0 through 1.13.16 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

CVE-2024-47117: Improper Neutralization of Input During Web Page Generation

IBM Carbon Design System Carbon Charts 0.4.0 through 1.13.16 is vulnerable to cross-site scripting. This vulnerability allows an authenticated user to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a...

PT-2024-32413 · Ibm · Ibm Carbon Design System

Name of the Vulnerable Software and Affected Versions: IBM Carbon Design System Carbon Charts versions 0.4.0 through 1.13.16 Description: The issue allows an authenticated user to embed arbitrary JavaScript code in the Web UI, altering the intended functionality and potentially leading to...