Progress KendoReact CVE-2026-106138

Requires the application to use the default Chart tooltip of @progress/kendo-react-charts (version >=1.1.0 and <16.2.0) in either single-point or shared mode, where the formatted point value is rendered without HTML encoding. The attacker must have low-privilege access that lets them influence a string value bound to the chart (e.g., a data label, category, or series value). Exploitation is further limited because it requires victim user interaction - the malicious JavaScript only executes when a user hovers over the affected data point - so a second human must view the poisoned chart. Applications that supply only trusted/sanitized values to charts, or that have upgraded to 16.2.0 or later, are not exploitable.

This is a moderate-severity stored/influenced XSS (CWE-80) in the KendoReact Chart tooltip, best characterized as a real-but-conditional risk rather than an urgent emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) is internally consistent with the description: exploitation requires an attacker who already holds low privileges (PR:L) to inject a string bound to the chart, and requires a separate victim to hover over the affected data point (UI:R), which meaningfully constrains real-world exploitability. No EPSS score, SSVC decision, KEV listing, or POC was supplied in the input; there is no public exploit identified at time of analysis and no evidence of active exploitation. The scope change (S:C) and only Low confidentiality/integrity impact reflect that injected JavaScript runs in the victim's browser session rather than granting direct server compromise. Net: a legitimate finding to patch on a normal cycle, not a drop-everything priority, because it needs both attacker-controlled input and victim interaction and carries no availability or high-impact component. No signals conflict, but the absence of EPSS/KEV/SSVC data means the probability of exploitation cannot be quantified from the input alone.

A low-privileged user of a web application built with KendoReact submits a value (e.g., a label, series name, or data field) containing an HTML event handler that is later bound to a chart data point. When another user - potentially a higher-privileged operator or admin - views the chart and hovers over that point, the default tooltip renders the attacker's string as raw HTML and the event handler fires, executing JavaScript in the victim's browser session. No public exploit code was identified in the provided data, and the CVSS network vector with low complexity means delivery is straightforward once the attacker can influence a bound string.