IBM Carbon Charts CVE-2026-94402

Exploitation requires the consuming application to pass attacker-influenced text into a Carbon Charts MeterChart component's title, AND that title must exceed the available container width so the vulnerable Title.truncateTitle() code path performs the unsanitized innerHTML write (a short title that is not truncated does not trigger the sink). The affected code exists only in Carbon Charts versions 0.4.0 through 1.27.19. Limiting factors: user interaction is required (UI:R) - a victim must load the page rendering the chart; the attacker does not need application privileges at the library level, but the practical ability to plant the payload depends on whether the host app exposes a user-controllable label and on its own sanitization. This is not exploitable against a default standalone configuration with no untrusted title input.

This is a moderate-severity reflected/stored DOM-based XSS (CWE-79) in IBM Carbon Charts, rated CVSS 6.1 with vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The network vector, low complexity, and no-privilege requirement raise the theoretical reach, but exploitation is gated by UI:R - a victim must render a MeterChart whose attacker-influenced title overflows its container - which caps impact at the limited confidentiality/integrity typical of session-context script execution (no availability impact). No EPSS score, CISA KEV listing, POC, or SSVC decision point was supplied with this input, so there is no evidence of active exploitation or automatable mass-exploitation; this reads as a standard client-side XSS to be patched on a normal cadence rather than an emergency. Real-world risk is highly dependent on the consuming application: the severity materializes only where untrusted user input is allowed to flow into a MeterChart title, so the effective privilege needed to plant the payload is defined by the host app, not the library. Absence of exploitation signals (EPSS/KEV/POC) is a gap in the provided data, not proof of low interest - treat it as unknown rather than confirmed-benign.

An attacker submits a crafted, overly long MeterChart title (e.g., through a profile field, dashboard label, or report name that an application renders via Carbon Charts) containing an HTML/script payload. When a victim loads the dashboard and the title exceeds the container width, Title.truncateTitle() writes the attacker's substring back into the DOM via innerHTML, executing the script in the victim's session. No public exploit code was identified at time of analysis.