Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue (CVE-2026-106139)

Updated on Oct 9, 2026

Description

Security Notification – October 2026 - CVE-2026-106139

• Progress® Kendo UI for Vue 2026 Q3 (10.0.0) or earlier.

What Are the Impacts

The default Chart tooltip renders the formatted point value as raw HTML, in both the single-point and the shared tooltip. An attacker who can influence a string value bound to the chart can introduce HTML containing event handlers. JavaScript can execute in a user's browser when the user hovers over the affected data point, compromising the confidentiality and integrity of data accessible to the affected application.

Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version, relies on the default Chart tooltip (no custom render function), and binds string values that an attacker can influence. Numeric series are not affected. Tooltips rendered through a custom render function that outputs the value as text are not affected.

Issue

• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CAPEC-18: XSS Targeting Non-Script Elements

Solution

The issue is fixed in version 10.1.0 of @progress/kendo-vue-charts. The Progress Telerik team strongly recommends upgrading to this version or later.

Current Version	Update to
>= 2.5.0 && <= 10.0.0	>= 10.1.0

To update, install the latest version of the package, for example npm install @progress/kendo-vue-charts@latest. All customers who have a license for Progress® Kendo UI for Vue can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, provide a custom render template to the ChartTooltip component. Vue encodes text content in templates, so any markup in the series name or formatted value is displayed as plain text.

For the single-point tooltip:

vue

<ChartTooltip :render="'tooltipRender'">
    <template #tooltipRender="slotProps">
        <span>{{ slotProps.point.formattedValue }}</span>
    </template>
</ChartTooltip>

For the shared tooltip:

vue

<ChartTooltip
    :shared="true"
    :render="'sharedTooltipRender'"
>
    <template #sharedTooltipRender="slotProps">
        <table>
            <tbody>
                <tr>
                    <th :colspan="2">{{ slotProps.categoryText }}</th>
                </tr>
                <tr
                    v-for="(point, index) in slotProps.points"
                    :key="index"
                >
                    <td>{{ point.series.name }}</td>
                    <td>{{ point.formattedValue }}</td>
                </tr>
            </tbody>
        </table>
    </template>
</ChartTooltip>

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.

External References

CVE-2026-106139 (MEDIUM)

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4)

In Progress® Telerik® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 10.1.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 10.1.0.

CREDIT: Abhishek Nandkumar Bhaskar (Abhi-Hackz)