CVE-2026-106138

Name of the Vulnerable Software and Affected Versions @progress/kendo-react-charts versions 1.1.0 through 16.1.x

Description The default Chart tooltip renders formatted point values as raw HTML without encoding in both single-point and shared tooltips. An attacker with low privileges who can influence a string value bound to the chart can inject HTML containing event handlers. This allows the execution of JavaScript in a user's browser when they hover over the affected data point, potentially compromising the confidentiality and integrity of data accessible to the application.

Recommendations Update @progress/kendo-react-charts to version 16.2.0 or later.