CVE-2026-106138: KendoReact 1.1.0 to before 16.2.0

Affected technology

KendoReact · 1.1.0 to before 16.2.0
Progress Software

Description’s affected range: version 1.1.0 and prior to 16.2.0

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 3.1): Network (remote) · Low privileges required · User interaction required

What an attacker can do

An attacker with low privileges who can influence a string value bound to the chart can supply HTML containing event handlers that execute JavaScript in a user's browser when the user hovers over the affected data point. Vendor/CNA’s CVSS 3.1 assessment (base score 5.4/10) rates confidentiality and integrity impact as low; availability impact as none.