CVE-2026-106139: XSS Vulnerability in Progress Kendo UI for Vue Chart Tooltip

Cross-Site Scripting (XSS) in Kendo UI for Vue Chart Tooltip (CVE-2026-106139) Overview Vulnerability ID: CVE-2026-106139 Publication Date: October 10, 2026 Affected Versions: Progress® Kendo UI for Vue 2026 Q3 (10.0.0) and earlier versions Impact The default chart tooltip renders formatted point values in raw HTML format, including both single-point and shared tooltips. An attacker can inject HTML containing event handlers by influencing string values bound to the chart. JavaScript can be executed in the user's browser when hovering over affected data points, compromising the confidentiality and data integrity of the affected application. Vulnerability Conditions An application may be vulnerable if it uses an affected version, utilizes the default chart tooltip (without a custom function), and binds string values. Numeric series are not affected. Tooltips rendered via a custom function (which output values as text) are not affected. Classification CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) CAPEC-18: XSS targeting non-script elements Solution This issue is fixed in version 10.1.0 of . Upgrading to this version or later is strongly recommended. Update method: Install the latest version of the package, e.g., . All customers with a Progress® Kendo UI for Vue license can access downloads via Product Downloads or Your Account. Mitigations If an immediate upgrade is not possible, provide a custom template for the component. Vue encodes text content within templates, ensuring that any markup in series names or formatted values is displayed as plain text. Single-Point Tooltip Example Shared Tooltip Example Notes For any questions or concerns, please open a new support ticket. Thanks to Abhishek Nandkumar Bhaskar (Abhi-Hackz) for responsible disclosure and cooperation. External References CVE-2026-106139: Link CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4) Credits CREDIT: Abhishek Nandkumar Bhaskar (Abhi-Hackz)

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2026-106139: XSS Vulnerability in Progress Kendo UI for Vue Chart Tooltip