Progress Kendo UI for jQuery: Cross-site scripting (CVE-2026-124697)
Progress Kendo UI for jQuery Chart shared-tooltip rendering treats bound category and series-name values as raw HTML, allowing injected markup to execute as JavaScript in the user's browser context.
CVE search metadata
CVE search record: CVE-2026-124697. KEV: no. Product: Kendo UI for jQuery. Brief: Progress Kendo UI for jQuery: Cross-site scripting (CVE-2026-124697). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124697/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:46 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery contains a vulnerability in the Chart shared-tooltip rendering logic where category and series-name values are treated as raw HTML. Attackers capable of influencing the data consumed by the Chart can inject markup that executes as JavaScript when a user displays the shared tooltip.
Impact
Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.
Recommendation
Refer to the official vendor documentation for details regarding affected versions and security updates.