# Cross-Site Scripting via DropDownButton and SplitButton Item Attributes in Kendo UI for jQuery (CVE-2026-124687)

## Description

October 2026 - [CVE-2026-124687](https://www.cve.org/CVERecord?id=CVE-2026-124687)

* Progress® Kendo® UI for jQuery versions prior to `2026.4.1111`.

### What Are the Impacts

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to `2026.4.1111` the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in `2026.4.1111`.

### Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version of DropDownButton or SplitButton and derives item IDs or attributes from attacker-controlled or lower-privileged input.

## Issue

* CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
* CAPEC-18: XSS Targeting Non-Script Elements

## Solution

Upgrade to the fixed version listed below as soon as it becomes available.

| Current Version                   | Update to              |
| --------------------------------- | ---------------------- |
| `>=2022.2.621` && `<=2026.3.1015` | `2026.4.1111` or later |

Follow the [update instructions](https://www.telerik.com/kendo-jquery-ui/documentation/intro/installation/npm) for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Notes

* If you have questions or concerns about this issue, open a new Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/). Technical Support is available to customers with an active support plan.
* We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.

## External References

[CVE-2026-124687](https://www.cve.org/CVERecord?id=cve-2026-124687) (MEDIUM)

**CVSS:** 4.7

**CVSS v3.1 Vector:** `CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N`.

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to `2026.4.1111` the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in `2026.4.1111`.