# Cross-Site Scripting in Kendo UI for jQuery Chart Default Tooltip Values (CVE-2026-124698)

## Description

November 2026 - [CVE-2026-124698](https://www.cve.org/CVERecord?id=CVE-2026-124698)

### What Are the Impacts

An attacker who can influence a point value displayed in a Chart's default tooltip can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.

### Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version and allows an attacker to control string values displayed in a Chart's default tooltip.

## Issue

* CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
* CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).

## Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

| Current Version                                               | Update to        |
| ------------------------------------------------------------- | ---------------- |
| Reported version not provided; affected range not established | `>= 2026.4.1111` |

Follow the [Kendo UI for jQuery update instructions](https://www.telerik.com/kendo-jquery-ui/documentation/intro/installation/upgrades). Licensed customers can access [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Notes

* If you have questions about this issue, open a Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/).
* We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.

## External References

[CVE-2026-124698](https://www.cve.org/CVERecord?id=CVE-2026-124698)

**CVSS:** CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4).

In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established; the issue is fixed in version 2026.4.1111.

Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)