CVE-2026-94402: @carbon/charts 0.4.0 through 1.27.19; +4 more affected products

Affected technology

@carbon/charts · 0.4.0 through 1.27.19
IBM

@carbon/charts-react · 0.4.0 through 1.27.19
IBM

@carbon/charts-angular · 0.4.0 through 1.27.19
IBM

@carbon/charts-vue · 0.4.0 through 1.27.19
IBM

@carbon/charts-svelte · 0.4.0 through 1.27.19
IBM

Description’s affected range: through 1.27.19

Component: Not specified by the source
Function: re-inserts

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · No privileges required · User interaction required

What an attacker can do

A remote attacker could exploit this vulnerability to execute arbitrary JavaScript in the victim's browser session. Vendor/CNA’s CVSS 3.1 assessment (base score 6.1/10) rates confidentiality and integrity impact as low; availability impact as none.