# Cross-Site Scripting in Kendo UI for jQuery Form Item Hints (CVE-2026-124695)

## Description

November 2026 - [CVE-2026-124695](https://www.cve.org/CVERecord?id=CVE-2026-124695)

### What Are the Impacts

An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.

### Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version and allows an attacker to control Form item `items[].hint` values.

## Issue

* CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
* CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).

## Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

| Current Version                        | Update to        |
| -------------------------------------- | ---------------- |
| Affected version range not established | `>= 2026.4.1111` |

Follow the [Kendo UI for jQuery update instructions](https://www.telerik.com/kendo-jquery-ui/documentation/intro/installation/upgrades). Licensed customers can access [Product Downloads | Your Account](https://www.telerik.com/account/downloads/product-download).

## Notes

* If you have questions about this issue, open a Technical Support case in [Your Account | Support Center](https://www.telerik.com/account/support-center/contact-us/).
* We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.

## External References

[CVE-2026-124695](https://www.cve.org/CVERecord?id=CVE-2026-124695)

**CVSS:** CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7).

In Progress Kendo UI for jQuery Form, the items\[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established; the issue is fixed in version 2026.4.1111

Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)