Threats affecting pkg:github/airerr/datagear

CVE-2026-19110 is a cross-site scripting (XSS) vulnerability in DataGear version 5.0.0. The issue exists in the HtmlTplDashboardWidgetHtmlRenderer function of the Chart Name Handler component, where manipulation of the Title argument can lead to XSS. The vulnerability can be exploited remotely and has been publicly disclosed. The vendor has not responded or provided a fix. The CVSS score is 4.8, indicating a medium severity risk.