CVE-2026-106138: Progress Software Kendoreact

Medium severity, CVSS 5.4. EPSS: 0.2% chance of exploitation in the next 30 days.

In Progress® KendoReact (@progress/kendo-react-charts) starting with version 1.1.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.

Affected products

• Progress Software Kendoreact: from 1.1.0, before 16.2.0 (fixed in 16.2.0)

Published 2026-10-10. Last modified 2026-10-10.