CVE-2026-106138: CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) in Progress Software KendoReact

In Progress KendoReact versions >=1.1.0 and <16.2.0, the default Chart tooltip renders formatted point values as raw HTML without proper encoding. This improper neutralization of script-related HTML tags (CWE-80) enables a low-privileged attacker who can control string values bound to the chart to inject HTML containing event handlers that execute JavaScript in the victim's browser upon hover. This cross-site scripting (XSS) vulnerability can lead to compromise of confidentiality and integrity of data accessible by the affected application. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and partial confidentiality and integrity impact.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of the affected application when a user interacts with the chart tooltip. This can lead to compromise of confidentiality and integrity of data accessible to the application. Availability is not impacted. No known exploits in the wild have been reported.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. In the meantime, avoid binding untrusted or user-controllable strings directly to the chart tooltip or ensure proper HTML encoding before rendering. Monitor Progress Software advisories for an official fix or update.