CVE-2026-106139: Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue
In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
@progress/kendo-vue-chartsto a version that resolves this vulnerability.Fixed in 16.2.0
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using @progress/kendo-vue-charts from version 2.5.0 up to, but not including, 16.2.0 are affected when they display attacker-influenced string values in the default Chart tooltip. Both single-point and shared tooltips are affected.
What must an attacker be able to do to exploit it?
The attacker needs low-privilege ability to influence a string value bound to a chart. They can supply HTML with event handlers, which executes when another user hovers over the affected chart data point.
Is user interaction required?
Yes. JavaScript execution requires a user to hover over the chart data point containing the attacker-controlled value.
What should be done if upgrading is not immediately possible?
Ensure that untrusted string values cannot be bound to affected charts, or sanitize/encode those values before they are used as chart point values. The vulnerable behavior is in the default tooltip's handling of formatted point values as raw HTML.
How can I determine whether my application is affected?
Check whether @progress/kendo-vue-charts is installed at version 2.5.0 through versions before 16.2.0, and whether default single-point or shared Chart tooltips display string values that can be influenced by lower-privileged users.