Kendo UI for jQuery: XSS in the Chart default tooltip (CVE-2026-124698)

A malicious point value can execute script when a user hovers over it in an affected Kendo Chart default tooltip. Upgrade the widget to protect people viewing charts that contain untrusted point values.

Public CVE record · Vendor or publisher advisory · Native module source

CVE advisory record · Vendor advisory · Module source

Result. Both baseline requests returned HTTP 200 with zero marker change. The native rule refused the second probe and let the benign request through. These observations establish request refusal for the tested bytes. The synthetic fixture ran through Eden 1.103.0 on November 12, 2026 (UTC).

The vulnerability

The default tooltip renders string point values as HTML. An attacker who can control a point value may cause script execution when the user hovers over that point. The default tooltip consumes point values, while the shared tooltip advisory covers category and series names.

Progress verified affected releases at least as far back as 2016.2.607 through 2026.3.1015. The fix is in 2026.4.1111. The CVE record reports a CVSS base score of 7.1.

The Eden patch

Tier 1 — declarative policy. The recorded policy denies requests to /kendo-ui/chart2 and its descendants. The empty method list leaves the deny unrestricted by HTTP method. This is a coarse rule and blocked the benign probe on the same path.

{
  "version": 1,
  "profile": "http-structure-v1",
  "policy": {
    "version": 1,
    "rules": [
      {
        "scope": {
          "methods": [],
          "path": "/kendo-ui/chart2",
          "descendants": true
        },
        "require": {
          "kind": "deny"
        }
      }
    ]
  }
}

Tier 2 — native Rust module. gabriel_kendochart2_v1 waits for the request to be complete, checks whether the request target starts with /kendo-ui/chart2, and looks for any configured marker in the body. The substring comparison is ASCII case-insensitive. Outside that prefix or without a marker, the module returns Continue. The shown lines are excerpts from the linked source.

const ROUTE: &[u8] = b"/kendo-ui/chart2";
static NEEDLES: [&[u8]; 2] = [b"<SCRIPT", b"OnErRoR="];

NEEDLES.iter().any(|n| find_ignore_case(body, n).is_some()) && return Ok(Decision::Refuse);

Implement the remediation

Use this procedure in an isolated fixture to reproduce the scoped restriction. Follow the vendor update for the underlying exposure. See deployment prerequisites.

1. Prepare the target. Verify the loaded product and version against the advisory. Use a compatible Eden HTTP interlay and an authenticated operator with Configure permission. Use the recorded declaration and the linked source when applicable.
2. Apply the declarative policy. Scope the policy to /kendo-ui/chart2 and descendants (all methods, deny). Set INTERLAY to the target interlay UUID in the authenticated Eden CLI. Run an authenticated GET /api/v1/interlays/{interlay} with X-Eden-Verbose: true. Save its complete current settings object as current-settings.json and retain the prior remediation declaration for recovery. Set IDEMPOTENCY_KEY to a fresh key for this intended mutation.

Save the JSON in the patch section as remediation.json.

jq -e --slurpfile policy remediation.json \
  '.remediation = $policy[0] | {settings: .}' current-settings.json \
  > interlay-update.json
eden api request PATCH "/api/v1/interlays/$INTERLAY" \
  --header "Idempotency-Key:$IDEMPOTENCY_KEY" \
  --body-file interlay-update.json --content-type application/json --confirm

3. Verify the serving policy. Read back the interlay.

eden api request GET "/api/v1/interlays/$INTERLAY" \
  --header 'X-Eden-Verbose:true'

Check that remediation_status.state is ready and both desired and effective SHA-256 values match the intended declaration. Replay both recorded probes in an isolated fixture. The baseline recorded no marker, so the check establishes request refusal for the tested bytes. 4. Restore the previous policy. Coordinate the change with any other operator updating this interlay. Read current settings again and merge the saved remediation field into them. If the prior settings had no remediation field, omit it in the replacement. Send the same PATCH with a fresh idempotency key, then read back the intended state. Repeat the verification probes. Keep the affected route isolated if restoring the prior settings reopens exposure.

Vendor update. Use the advisory to select the fixed release for the installed branch. Reported fixed releases include 2026.4.1111. Follow the vendor’s update instructions and confirm the version actually loaded by the service.

Fixture and probes

The fixture was a synthetic HTTP handler behind Eden. It answered the probes and kept a separate counter that increased when the handler recognized its marker bytes. The counter measures a fixture effect. An HTTP 200 from the baseline does not by itself establish that the counter moved.

Request. POST /kendo-ui/chart2/shared for the benign probe and the marked probe.

The benign probe sent a plain tooltip value. The second body used an uppercase script fragment and a mixed-case JSON key named OnErRoR. That key is followed by JSON punctuation, so the recorded body did not contain the literal event-handler marker with an equals sign. The case-insensitive native rule refused the probe.

Measured comparison (2026-11-12 UTC)

The values after each status are the observed increases in the backend marker counter.

Request latency

Eden telemetry request spans measured in the fixture. Latencies are in microseconds (µs).

These are durations of the recorded request spans. The passing request includes the path to the fixture, while the policy and native refusal rows describe requests that ended at Eden. The rows represent different request outcomes, so their difference does not isolate module CPU time. The sample counts are shown for each arm.

Signed module authority

The module import returned HTTP 201 and required explicit activation. Signature verification was deferred at import. Read-only inspection returned HTTP 403, admission with a tampered statement returned HTTP 400, and admission with an invalid signature returned HTTP 403. The activation receipt reported the module serving on all expected shards.

After revocation, the same marked request received HTTP 503. Re-approval and reactivation restored HTTP 403. The source digest below identifies the linked Rust file. The binary digest identifies the artifact recorded in the activation evidence.

• Source SHA-256 49846cc0bb5fdce88a8792b09d1be14ff93c1541c683b783d6aef8388b6ccdd1
• Tested binary SHA-256 6a3e19f7a758e8f191ca7368fa2637e88e05b4a4a548f48b618132ca6c46cbee

Test scope

The backend oracle searches for lowercase markers using case-sensitive byte matching. It returned 200 and recorded no marker for the mixed-case baseline. This experiment shows the gateway refused the tested bytes and preserved the benign request. It supplies no baseline evidence of an effect and did not exercise the default tooltip in a browser.

Evidence and artifacts

• Public CVE record
• Vendor or publisher advisory
• Published module source