CVE-2026-106138 | BDVDB-2026-385482 Detail

Description#

In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.

Impact#

Weaknesses#

References#

Exploit#

History#

1. Version 12026-10-10Record published in the CVE List.
2. Version 22026-10-15Most recent update recorded in the CVE List.