Cross-Site Scripting in Kendo UI for jQuery Chart Default Tooltip Values (CVE-2026-124698)
Description
November 2026 - CVE-2026-124698
What Are the Impacts
An attacker who can influence a point value displayed in a Chart's default tooltip can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and allows an attacker to control string values displayed in a Chart's default tooltip.
Issue
- CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
- CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
| Reported version not provided; affected range not established | >= 2026.4.1111 |
Follow the Kendo UI for jQuery update instructions. Licensed customers can access Product Downloads | Your Account.
Notes
- If you have questions about this issue, open a Technical Support case in Your Account | Support Center.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4).
In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established; the issue is fixed in version 2026.4.1111.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)