CVE-2026-106138: Cross-Site Scripting via Chart Tooltip in KendoReact

The default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and shared tooltip. A low-privileged attacker who can influence a string value bound to the chart can supply HTML with event handlers that run JavaScript in a user’s browser when the user hovers over the affected data point.

CVE ID

CVE-2026-106138

Vendor

Progress KendoReact

Product

@progress/kendo-react-charts (npm)

Weakness

CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSS 3.1

5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected

1.1.0 through 16.1.x

Fixed in

16.2.0

Published

Oct 10, 2026

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz) — finder

Assigner (CNA)

Progress Software

Remediation

Upgrade @progress/kendo-react-charts to 16.2.0 or later.

References

About this disclosure

This vulnerability was found and reported by Abhishek Nandkumar Bhaskar (Abhi HackZ, credited in the CVE record as Abhi-Hackz) through the vendor's vulnerability disclosure program, and credited to him as finder in the official CVE record assigned by Progress Software as the CVE Numbering Authority. Proof-of-concept details are withheld; the facts on this page are taken from the public CVE record and the vendor advisory. For the background and the bug class explained, read Four CVEs in Progress Software Products and From a Bugcrowd VDP Report to a Published CVE.

Other CVEs credited to Abhishek Bhaskar