Cross-Site Scripting Vulnerability in Progress Kendo UI for jQuery Chart Tooltips
CVE-2026-124698

7.1HIGH

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
12 November 2026

What is CVE-2026-124698?

The Kendo UI for jQuery Chart has a vulnerability where the default tooltip displays point values as unescaped HTML. This allows attackers to manipulate string point values, leading to potential JavaScript execution when users interact with the tooltip. Such exploitation can undermine data confidentiality and integrity within the user's browser environment. The issue affects versions 2016.2.607 and 2026.3.1015, with remediation available in version 2026.4.1111.

Affected Version(s)

Kendo UI for jQuery 2016.2.607 <= 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.