CVE-2026-106139
5.4 MEDIUMPublished 2026-10-10 · Updated 2026-10-15
AI analysis for this CVE has not been generated yet. Raw NVD data is shown below.
NVD description
In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-80
All references
Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.
Related CVEs
- MEDIUMCVE-2023-54409PoC
- LOWCVE-2026-102279PoC
- UNSCOREDCVE-2026-103437
- UNSCOREDCVE-2026-103438
- UNSCOREDCVE-2026-103439
- UNSCOREDCVE-2026-103443
- UNSCOREDCVE-2026-103444
- UNSCOREDCVE-2026-103445
Related by shared AI tags and CWE weakness class. Browse the full archive.