CVE-2026-124698: Cross-Site Scripting in Kendo UI for jQuery Chart Shared Tooltip
In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using the Kendo UI for jQuery Chart default tooltip are exposed if an attacker can influence a chart point value that is handled as a string. The injected code runs when a user hovers over the affected point.
Which versions should be remediated?
Version 2026.3.1015 is identified as the latest vulnerable version, and the issue is fixed in 2026.4.1111. Version 2016.2.607 and earlier may also be affected, although earlier releases have not been verified.
Is a non-default configuration required for exploitation?
No. The affected behavior is the Chart default tooltip rendering point values as raw HTML.
What can be done if upgrading is not immediately possible?
Prevent untrusted input from reaching string chart point values, since exploitation requires an attacker to influence such a value. Review chart data sources and treat attacker-controlled point-value strings as unsafe.