CVE-2026-94402Published

IBM vulnerable to cross-site scripting (XSS) via unsanitized title truncation

cve-program · CVE-2026-94402

Published

@carbon/charts

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "IBM",
                    "product": "@carbon/charts",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.4.0",
                            "lessThanOrEqual": "1.27.19",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:carbon_charts:0.4.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:carbon_charts:1.27.19:*:*:*:*:*:*:*"
                    ]
                }

@carbon/charts-react

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "IBM",
                    "product": "@carbon/charts-react",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.4.0",
                            "lessThanOrEqual": "1.27.19",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:carboncharts_react:0.4.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:carboncharts_react:1.27.19:*:*:*:*:*:*:*"
                    ]
                }

@carbon/charts-angular

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "IBM",
                    "product": "@carbon/charts-angular",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.4.0",
                            "lessThanOrEqual": "1.27.19",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:carboncharts_angular:0.4.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:carboncharts_angular:1.27.19:*:*:*:*:*:*:*"
                    ]
                }

@carbon/charts-vue

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "IBM",
                    "product": "@carbon/charts-vue",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.4.0",
                            "lessThanOrEqual": "1.27.19",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:carboncharts_vue:0.4.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:carboncharts_vue:1.27.19:*:*:*:*:*:*:*"
                    ]
                }

@carbon/charts-svelte

Vendor product

Original vendor version evidence · not evaluated as a NuGet range

{
                    "vendor": "IBM",
                    "product": "@carbon/charts-svelte",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "0.4.0",
                            "lessThanOrEqual": "1.27.19",
                            "versionType": "semver"
                        }
                    ],
                    "cpes": [
                        "cpe:2.3:a:ibm:carboncharts_svelte:0.4.0:*:*:*:*:*:*:*",
                        "cpe:2.3:a:ibm:carboncharts_svelte:1.27.19:*:*:*:*:*:*:*"
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON