CVE-2026-106138: Cross-Site Scripting via Chart Tooltip in KendoReact
In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@progress/kendo-react-chartsto a version that resolves this vulnerability.Fixed in 16.2.0
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using @progress/kendo-react-charts from version 1.1.0 through versions prior to 16.2.0 are exposed if untrusted or attacker-influenced string data can be bound to a chart point and users can hover that point.
What does an attacker need to exploit it?
The attacker needs low-privilege ability to influence a string value displayed in a chart. They can supply HTML with event handlers, which executes in a user's browser when that user hovers over the affected point.
Are both chart tooltip modes affected?
Yes. The default tooltip behavior is affected for both single-point tooltips and shared tooltips.
How can I determine whether my application is affected?
Check whether the application uses a version of @progress/kendo-react-charts earlier than 16.2.0 and renders attacker-influenced string values in chart data. Test both single-point and shared tooltip configurations by hovering a point containing such data.