Cross-Site Scripting in the Kendo UI for jQuery Chart Shared Tooltip (CVE-2026-124697)
Description
November 2026 - CVE-2026-124697
What Are the Impacts
An attacker who can influence category or series-name values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and allows an attacker to control category or series-name values in the Chart.
Issue
- CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
- CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
Reported version: 2026.3.1015; affected range not established | >= 2026.4.1111 |
Follow the Kendo UI for jQuery update instructions. Licensed customers can access Product Downloads | Your Account.
Notes
- If you have questions about this issue, open a Technical Support case in Your Account | Support Center.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7).
In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1015; the first affected release and the fixed release have not been established.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)