CVE-2026-106139: CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) in Progress Software Kendo UI for Vue

In Progress Kendo UI for Vue versions >=2.5.0 and <10.1.0, the default Chart tooltip renders formatted point values as raw HTML without proper encoding. This improper neutralization of script-related HTML tags (CWE-80) allows an attacker with low privileges who can influence the string bound to the chart to inject HTML containing event handlers that execute JavaScript in the victim's browser upon hovering over the data point. This results in a reflected XSS vulnerability that can compromise confidentiality and integrity of data accessible to the affected application.

Successful exploitation allows execution of arbitrary JavaScript in the context of the affected application, potentially compromising confidentiality and integrity of data accessible to the user. The attack requires user interaction (hovering over the chart tooltip) and low privileges to inject malicious content. There is no indication of impact to availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, avoid binding untrusted or user-controllable strings to chart tooltips or sanitize/encode such data before rendering. Monitor vendor communications for official patches or updates.