Cross-site Scripting in Calendar and MultiViewCalendar in Kendo UI for jQuery (CVE-2026-106153)
Description
October 2026 - CVE-2026-106153
- Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.
What Are the Impacts
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data. The issue is fixed in version 2026.3.1015.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and any of the following are true:
- An attacker can control
data.urlvalues rendered by the Calendar or MultiViewCalendar month content template. - An attacker can control culture-derived
data.titlevalues rendered by the month content template.
Issue
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
- CAPEC-18: XSS Targeting Non-Script Elements
The month content templates insert data.url into a link and data.title into an HTML attribute without appropriate safeguards. The reported reproduction uses a javascript: URL and a culture day name containing a quote and an event-handler attribute. URL validation is required in addition to HTML attribute encoding; encoding alone does not make an executable URL safe.
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 2011.3.1007 && <= 2026.3.811 | >= 2026.3.1015 |
The lower bound uses the earliest version listed in the report, not a confirmed first affected release. The reported environment versions have not been verified as Kendo UI release versions, and each component's affected range remains unconfirmed. Earlier versions must not be assumed unaffected.
Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVE-2026-106153 (Medium)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4)
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data. The issue is fixed in version 2026.3.1015.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)