Basic Cross-site Scripting (XSS) Vulnerability (CVE-2026-106149)
Description
October 2026 - CVE-2026-106149
- Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.
What Are the Impacts
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and renders attacker-controlled Menu dataSource fields as HTML attributes.
Issue
- CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The Menu rendering functions rendering.itemCssAttributes, rendering.imageCssAttributes, and rendering.contentCssAttributes concatenate bound dataSource values into HTML attribute strings, allowing malicious input to introduce event-handler attributes.
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 2011.2.804 && <= 2026.3.811 | >= 2026.3.1015 |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVE-2026-106149 (Medium)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4)
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)