CVE-2026-106139 in Kendo UI for Vue
Summary
by MITRE • 10/10/2026
In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 10/10/2026
The vulnerability identified in Progress Kendo UI for Vue, specifically within the kendo-vue-charts package versions ranging from 2.5.0 up to but not including 16.2.0, represents a significant client-side security flaw rooted in improper neutralization of user input during web page generation. This issue manifests as an HTML injection vulnerability that escalates into Cross-Site Scripting due to the framework's handling of chart tooltip data. In modern single-page applications and dynamic dashboards, charts are frequently used to visualize complex datasets where values may be derived from external sources or user inputs. The core technical flaw lies in the default rendering behavior of both single-point tooltips and shared tooltips within the Kendo UI Chart component. When a developer binds a string value to the chart data series, which is then displayed in the tooltip upon user interaction such as hovering over a specific data point, the library fails to encode special HTML characters before inserting them into the Document Object Model. This lack of sanitization allows any arbitrary HTML markup included in the bound string to be interpreted directly by the browser's rendering engine rather than being treated as plain text.
From an operational perspective, this vulnerability enables a low-privilege attacker who has the ability to influence or inject data strings associated with chart points to execute malicious JavaScript code within the victim's browser session. The attack vector typically involves crafting a payload that includes HTML elements equipped with event handlers, such as onmouseover or onclick attributes, which trigger script execution when the user interacts with the tooltip. For instance, an attacker might embed a script tag or an image element with an error handler designed to exfiltrate sensitive cookies, session tokens, or other authentication credentials stored in the browser's local storage. Because this exploitation occurs entirely within the client-side environment, it bypasses server-side security controls and relies on social engineering or data manipulation techniques to get users to hover over compromised chart elements. The success of such an attack compromises the confidentiality of user data by allowing theft of sensitive information and impacts integrity by potentially enabling further actions like defacing pages or performing unauthorized operations under the victim's identity if session hijacking is achieved.
This vulnerability aligns with Common Weakness Enumeration category CWE-79, which covers Improper Neutralization of Input During Web Page Generation commonly known as Cross-Site Scripting. Specifically, it falls under subcategories related to reflected or stored XSS depending on whether the malicious payload is delivered via immediate user interaction or persisted in a database for later retrieval by other users. In terms of offensive security frameworks, this behavior corresponds to techniques found within MITRE ATT&CK's Execution and Collection tactics, particularly those involving browser-based command execution and credential harvesting through client-side script injection. The impact extends beyond simple script execution; it undermines the trust model of web applications that rely on data visualization components for critical business intelligence or monitoring functions. Organizations utilizing these versions of Kendo UI for Vue are exposed to risks where visual dashboards become vectors for compromising user sessions, leading to potential unauthorized access and data breaches.
Mitigation strategies must focus on immediate remediation through software updates as well as defensive coding practices if upgrading is not immediately feasible. The primary recommendation is to upgrade the @progress/kendo-vue-charts package to version 16.2.0 or later, where this specific rendering flaw has been addressed by implementing proper HTML encoding for tooltip content. For environments that cannot be updated immediately, developers should implement server-side validation and output encoding on any data strings bound to chart components before they are sent to the client. Ensuring that all user-supplied input is sanitized using a robust library or framework-provided escaping mechanisms can prevent malicious scripts from being injected into the DOM. Additionally, implementing Content Security Policy headers with strict directives regarding script sources can provide an additional layer of defense by restricting where executable JavaScript can be loaded from, thereby mitigating the impact even if XSS vectors are present in the application's data flow. Regular security audits and static code analysis tools configured to detect unsafe HTML rendering patterns should also be employed to identify similar vulnerabilities across the application stack before they reach production environments.