Kendo Vue Charts CVE-2026-106139

Requires (1) an attacker holding low privileges in the application who can influence a string value bound to the chart - e.g. a username, label, or data field persisted and later plotted; (2) use of the default Chart tooltip (single-point or shared), which renders the formatted point value as raw HTML without encoding; (3) an affected version of @progress/kendo-vue-charts from 2.5.0 up to but not including 16.2.0; and (4) a victim user hovering over the poisoned data point (UI:R) to trigger execution. Exploitation is limited by the need for prior authenticated access and mandatory victim interaction, and by the fact that applications using a custom tooltip template that encodes values, or upgraded to 16.2.0, are not exposed.

This is a moderate, not high-priority, issue whose signals are internally consistent. The vendor-provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) describes a stored cross-site scripting flaw (CWE-80): network-reachable and low-complexity, but gated by two meaningful constraints - the attacker must already hold low privileges (PR:L) sufficient to influence a string value bound to the chart, and a victim must actively hover over the affected data point (UI:R). The scope change (S:C) reflects script executing in the victim's browser context rather than only the vulnerable component, but both confidentiality and integrity impacts are rated Low and availability is unaffected. No EPSS probability, CISA KEV listing, or public POC was provided in the input, so there is no public exploit identified at time of analysis and no evidence of active exploitation; the risk is therefore driven by the flaw's characteristics rather than observed threat activity. The dependence on prior authenticated access plus victim interaction makes mass, drive-by exploitation unlikely, placing this below network-unauthenticated RCE-class issues. One minor data inconsistency to verify: the supplied CVE ID is CVE-2026-106139 while the reference advisory URL ends in 'cve-2026-1061389' - confirm the canonical identifier with the vendor.

A low-privileged user of a multi-user Vue application (built with @progress/kendo-vue-charts) enters a crafted string - containing an HTML element with an event handler such as onmouseover - into a field that is subsequently bound to a chart series and rendered in the default tooltip. When another user, potentially a higher-privileged operator, hovers over that data point, the unencoded HTML executes JavaScript in their browser session. No public exploit code was provided in the input, so this remains a vendor-described scenario rather than a demonstrated one.