Threats Tagged 'ghsa-76j6-f7qm-jhqv'

A cross-site scripting (XSS) vulnerability exists in Progress Software KendoReact versions 1.1.0 up to but not including 16.2.0. The default Chart tooltip renders formatted point values as raw HTML without encoding, allowing an attacker with low privileges who can influence chart-bound string values to inject HTML with event handlers. This can lead to JavaScript execution in the user's browser when hovering over the affected data point, potentially compromising data confidentiality and integrity.