AIKIDO-2026-454830
@carbon/charts is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
61
CVE Score
Medium
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
TL;DR
Title.truncateTitle() writes a truncated substring of the untrusted chart title back into the DOM with an unsanitized d3 .html() call when the title is wider than its container, so markup in the title runs as HTML and executes in the victim's browser. The code performs no sanitization before the .html() write. In recent versions render() no longer visibly calls truncateTitle(), so current reachability of the method needs confirmation. The fix wraps the substring in sanitizeText() (DOMPurify with ALLOWED_TAGS: []) before the .html() write.
How do I fix this?
Upgrade the @carbon/charts, @carbon/charts-react, @carbon/charts-angular, @carbon/charts-vue and @carbon/charts-svelte packages to 1.27.20 or later.
Who does this affect?
You are affected if you are using a version that falls within the vulnerable range and render a chart whose title is wider than its container so truncateTitle truncates it.
Package
Versions
0.30.10 - 1.27.19
Fixed in 1.27.20Background info
@carbon/charts is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.30.10 - 1.27.19.
Get secure today,
quickly and for free.
Secure your code, cloud, and runtime in one central system. Connect a repo to discover what the reasoning agents find in your codebase.
No credit card required | Scan results in 32 seconds.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPAuthorized© All Intel data is openly available and commercially licensed.