CVE-2026-124698 in Kendo UI for jQuery
Summary
by MITRE • 11/12/2026
In Progress Kendo UI for jQuery, the Chart default tooltip renders point values as raw HTML. An attacker who can influence a string point value can inject markup that executes as JavaScript when a user hovers over the point. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/12/2026
The vulnerability identified in Progress Kendo UI for jQuery represents a classic Cross-Site Scripting (XSS) flaw rooted in improper input validation and output encoding within the Chart component's default tooltip rendering mechanism. This security defect allows an attacker to inject malicious markup that is interpreted as executable JavaScript code by the victim's web browser. The root cause lies in the framework's handling of point values associated with chart data points; when these values are rendered into tooltips, they are inserted directly into the DOM without sufficient sanitization or encoding. Consequently, if an application developer binds user-controlled or attacker-influenced strings to a chart series as raw HTML rather than plain text, the browser will parse and execute any embedded script tags or event handlers present in that string upon interaction with the specific data point.
From a technical perspective, this vulnerability aligns closely with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting. The attack vector is primarily stored or reflected depending on how the chart data is sourced within the consuming application. If the malicious payload originates from server-side storage and is subsequently rendered in the tooltip, it constitutes a Stored XSS vulnerability. Conversely, if the payload is derived directly from user input during the current session without persistence, it falls under Reflected XSS. In both scenarios, the operational impact is severe because tooltips are interactive elements that trigger on mouse hover events, providing an easy and non-intrusive method for exploitation. An attacker does not need to trick a user into clicking a link; merely hovering over a compromised chart point can initiate the malicious script execution within the context of the vulnerable web application.
The consequences of successful exploitation extend beyond simple defacement or alert boxes. Since the injected JavaScript executes in the same origin as the victim's session, it inherits all associated privileges and access rights. This enables attackers to perform actions such as stealing sensitive cookies, session tokens, or authentication credentials stored in local storage. It also allows for keylogging, form hijacking where user inputs are redirected to attacker-controlled servers, and potentially manipulating the DOM to alter application behavior or phish users by displaying fake login prompts. The integrity of data available in the browser context is compromised as the malicious script can read, modify, or exfiltrate any information accessible via JavaScript APIs within that domain. This poses significant risks for applications handling personal identifiable information (PII), financial records, or other confidential business intelligence displayed through Kendo UI charts.
Mitigation strategies must address both immediate remediation and long-term secure coding practices. The most effective solution is to upgrade the Progress Kendo UI library to version 2026.4.1111 or later, where this rendering flaw has been patched by implementing proper output encoding for tooltip content. For applications unable to update immediately due to compatibility constraints, developers should enforce strict input validation on all data points bound to chart series and ensure that any user-supplied strings are HTML-encoded before being passed to the Kendo UI Chart configuration. Additionally, leveraging Content Security Policy (CSP) headers can significantly reduce the impact of such vulnerabilities by restricting the sources from which scripts can be loaded or executed, thereby preventing many XSS payloads from running even if they are injected into the DOM.
This incident underscores the importance of treating all data rendered in HTML contexts as untrusted until explicitly validated and encoded. Security teams should incorporate static application security testing (SAST) tools configured to detect unsafe innerHTML assignments and dynamic analysis that specifically targets interactive UI components like tooltips, grids, and forms. Furthermore, developer training focused on secure JavaScript development practices is essential to prevent similar vulnerabilities in custom implementations of data visualization libraries. By adhering to these guidelines and maintaining up-to-date dependencies, organizations can effectively mitigate the risk associated with this class of client-side injection attacks.