New to Kendo UI for jQuery? Start a free 30-day trial

Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names (CVE-2026-124696)

Updated on Nov 11, 2026

An attacker who can influence a Spreadsheet sheet name can inject an event-handler attribute into the SheetsBar menu button. JavaScript executes when a user hovers over the button, potentially compromising the confidentiality and integrity of data available in the user's browser context.

Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version and allows an attacker to control Spreadsheet sheet names.

Issue

CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
Reported version not provided; affected range not established	`>= 2026.4.1111`

Follow the Kendo UI for jQuery update instructions. Licensed customers can access Product Downloads | Your Account.

Notes

If you have questions about this issue, open a Technical Support case in Your Account | Support Center.
We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.

External References

CVE-2026-124696

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7).

In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The reported version and first affected release have not been established; the issue is fixed in version 2026.4.1111.

Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)