CVE-2026-124697: Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip
In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker must be able to influence category or series-name values consumed by an affected Kendo UI for jQuery Chart. A user must then display the Chart's shared tooltip, which renders those values as raw HTML.
Which deployments should be prioritized for remediation?
Prioritize applications using Chart shared tooltips where category or series-name data can be influenced by untrusted users or external data sources. The issue is remotely reachable but requires user interaction to display the affected tooltip.
Which versions are affected and which version contains the fix?
Version 2016.2.607 or earlier may be affected, although earlier releases have not been verified. The latest vulnerable version is 2026.3.1015, and version 2026.4.1111 fixes the issue.
How can teams determine whether they are exposed?
Identify uses of Kendo UI for jQuery Charts with shared tooltips enabled, then determine whether bound category or series-name values can contain attacker-controlled content. Deployments running a version through 2026.3.1015 should be assessed, with older versions treated as potentially affected where applicable.