CVE-2026-106139mediumCWE-80

CVE-2026-106139: fallo de gravedad media en Progress Software Kendo UI for Vue

Cross-Site Scripting via Chart Tooltip in Kendo UI for Vue

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Kendo UI for Vue

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 5.4epss 0.1%
In Progress® Kendo UI for Vue (@progress/kendo-vue-charts) starting with version 2.5.0 and prior to 16.2.0, the default Chart tooltip renders the formatted point value as raw HTML without encoding, in both the single-point and the shared tooltip. An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Progress Software · Kendo UI for Vue
CVEs relacionadas — Progress Software Kendo UI for Vue

En el mismo producto, de las más peligrosas a las menos.

CVE-2026-106128MEDIUMPrototype Pollution in Progress Software Kendo UI for VueEPSS —CVE-2026-106143MEDIUMCross-Site Scripting in Progress Software Kendo UI for VueEPSS —