Quick answers
- Is CVE-2026-124698 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-124698 being exploited in the wild.
- How severe is CVE-2026-124698?
- High severity, with a CVSS score of 7.1, published 12 November 2026.
- Which products and versions are affected?
- Progress Kendo UI for jQuery through 2026.3.1015.
- Is there a fix for CVE-2026-124698?
- Yes: fixed in 2026.4.1111. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-124698 attacked?
- It is attacked over the network.
- Am I affected by CVE-2026-124698?
- Check whether you run Progress Kendo UI for jQuery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- Fixed in: 2026.4.1111
Technical details
The Chart component's default tooltip renders point values as raw HTML without sanitization, allowing stored or reflected XSS injection. An attacker must be able to control string point values displayed in the chart (CWE-79). When a user hovers over the affected point, injected JavaScript executes in the user's browser context with access to page data and cookies. A fix is available in version 2026.4.1111 and later.
Affected products
- Progress Kendo UI for jQuery through 2026.3.1015
Timeline
- 2026-11-12: disclosed
- 2026-11-12: patched: fix released as version 2026.4.1111