Vulnerability · Published Oct 10, 2026 · Assigned by ProgressSoftware
CVE-2026-106138Cross-Site Scripting via Chart Tooltip in KendoReact
Medium 5.4
In plain English
A medium-severity security flaw in KendoReact from Progress Software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 3% of all known vulnerabilities).
Official description
In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Progress Software | KendoReact | 1.1.0 – before 16.2.0 |
Weakness: CWE-80 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N