CVE-2026-124697 · Package
NO FIX YET · SEE WHAT TO DO
Kendo UI for jQuery's Chart shared tooltip renders bound category and series-name values as raw HTML instead of text. An attacker who can influence those values can make script run in a user's browser when the shared tooltip is displayed.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that bundle Kendo UI for jQuery and render Chart widgets with shared tooltips, where category or series-name values can be influenced by a user or an external source. Charts that only show fixed, server-controlled labels are lower risk. Projects that do not use the Kendo UI Chart widget can skip it.
Not affected if no-kendo-chart, no-shared-tooltip, static-labels
Who cares frontend, javascript, jquery, kendo-ui
kendo.all.min.js or @progress/kendo-ui package version in your project's package.json and lockfile2026.3.1015 are reported as the latest vulnerable line; 2016.2.607 or earlier may be affected but are unverified2026.4.1111In Progress Kendo UI for jQuery, Chart shared-tooltip rendering treats bound category and series-name values as raw HTML. An attacker who can influence values consumed by an affected Chart can inject markup that executes as JavaScript when a user displays the shared tooltip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. Version 2016.2.607 or earlier may be affected, but earlier releases have not been verified. The latest vulnerable version is 2026.3.1015; the issue is fixed in version 2026.4.1111.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.