CVE-2026-106138 in KendoReact
Summary
by MITRE • 10/10/2026
In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in Progress KendoReact, specifically within the kendo-react-charts package versions ranging from 1.1.0 up to but not including 16.2.0, represents a critical client-side security flaw rooted in improper neutralization of user input during rendering operations. This issue manifests as an Unsanitized Input or Output vulnerability where the default Chart tooltip component fails to encode HTML entities before injecting formatted point values into the Document Object Model. The technical mechanism involves the direct insertion of string data bound to chart elements without applying necessary sanitization filters, allowing raw HTML structures to be parsed and executed by the browser's rendering engine rather than being displayed as plain text.
From an operational perspective, this flaw enables a Stored or Reflected Cross-Site Scripting attack vector depending on how the input is sourced. An attacker with low privileges who has the ability to influence string values bound to the chart can inject malicious payloads containing JavaScript event handlers. When a legitimate user interacts with the application by hovering over data points associated with these manipulated strings, the browser interprets the injected HTML and executes the embedded scripts within the context of the vulnerable web page. This execution occurs in the same security domain as the original site, bypassing standard cross-origin restrictions that might otherwise limit the impact of such attacks.
The consequences of successful exploitation are severe for both data confidentiality and integrity. By executing arbitrary JavaScript in the user's browser, an attacker can perform session hijacking by stealing authentication cookies or tokens, redirect users to phishing sites, deface the application interface, or exfiltrate sensitive information displayed within the chart context. Since the attack relies on user interaction (hovering), it requires social engineering elements but leverages the trust relationship between the user and the web application effectively. This aligns with CWE-79, which classifies improper neutralization of input during web page generation as a primary cause for cross-site scripting vulnerabilities.
Furthermore, this vulnerability maps directly to MITRE ATT&CK technique T1059.007, specifically JavaScript execution via browser-based attacks. The exploitation path involves the attacker crafting specific input that persists or is reflected into the application state, followed by triggering the event handler through user interaction with the UI component. To mitigate this risk, developers must ensure that all dynamic content rendered in tooltips undergoes strict HTML encoding before insertion into the DOM. Utilizing React's built-in mechanisms for safe rendering, such as ensuring strings are treated as text rather than JSX elements where appropriate, or implementing a robust sanitization library like DOMPurify to strip dangerous tags and attributes is essential. Upgrading to version 16.2.0 or later of the kendo-react-charts package resolves this issue by applying proper encoding defaults in the tooltip rendering logic.