# Cross-Site Scripting in the Kendo UI for jQuery Chart Shared Tooltip (CVE-2026-124697)

## Description

November 2026 - [CVE-2026-124697](https://www.cve.org/CVERecord?id=CVE-2026-124697)

### What Are the Impacts

An attacker who can influence category or series-name values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.

### Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version and allows an attacker to control category or series-name values in the Chart.

## Issue

* CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
* CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).

## Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

| Current Version                                                 | Update to        |
| --------------------------------------------------------------- | ---------------- |
| Reported version: `2026.3.1015`; affected range not established | `>= 2026.4.1111` |

Follow the [Kendo UI for jQuery update instructions](https://www.telerik.com/kendo-jquery-ui/documentation/intro/installation/upgrades). Licensed customers can access [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Notes

* If you have questions about this issue, open a Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/).
* We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.

## External References

[CVE-2026-124697](https://www.cve.org/CVERecord?id=CVE-2026-124697)

**CVSS:** CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7).

In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1015; the first affected release and the fixed release have not been established.

Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)