Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery (CVE-2026-106159)

Updated on Oct 14, 2026

Description

October 2026 - CVE-2026-106159

• Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.

What Are the Impacts

ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing whitespace and additional attributes, including an event handler. JavaScript can execute in a user's browser when the user interacts with the affected button, compromising the confidentiality and integrity of data accessible to the affected application. URL scheme sanitization alone does not prevent this attribute injection.

Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version and allows an attacker to control button URLs in a ToolBar ButtonGroup. Restricting URLs to HTTPS alone does not prevent this attribute injection.

Issue

• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CAPEC-18: XSS Targeting Non-Script Elements

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
>= 2022.3.1109 && < 2026.3.811	>= 2026.3.1015

Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, use only trusted, application-defined button URLs or temporarily override the ButtonGroup _renderItems method after loading Kendo UI and before initializing the affected widgets. The override must create the anchor first and assign its sanitized href through the DOM attribute API, without first parsing the URL as part of an HTML string.

javascript

kendo.ui.ButtonGroup.fn._renderItems = function(items) {
	var that = this,
		groupOptions = that.options,
		children = that.element.children(),
		buttons = [];
	if (children.length > 0) {
		children.each(function(index) {
			var element = $(this),
				image = element.find("img").addClass("k-image"),
				disabled = element.is("[disabled]") || element.hasClass("k-disabled"),
				options = {
					badge: kendo.attrValue(element, "badge"),
					icon: !image[0] ? kendo.attrValue(element, "icon") : null,
					disabled: disabled,
					selected: !disabled ? element.is(".k-selected") : false,
					size: groupOptions.size,
					rounded: groupOptions.rounded,
					fillMode: groupOptions.fillMode,
					themeColor: groupOptions.themeColor
				};
			buttons.push(that._addButton(element, options));
			if (options.selected) {
				that.selectedIndices.push(index);
			}
		});
	}
	if (!items) {
		that._decorateButtons(buttons);
		return buttons;
	}
	items.forEach(function(item, index) {
		var text = item.text ? item.encoded === false ? item.text : kendo.htmlEncode(item.text) : "",
			sanitizedUrl = item.url ? kendo.sanitizeLink(item.url) : item.url,
 			element = item.url ? $("<a>").attr("href", sanitizedUrl === "#INVALIDLINK" ? sanitizedUrl : item.url) : $("<button>");
		element.html(text);
		if (item.attributes) {
			element.attr(item.attributes);
		}
		item = $.extend({}, item, {
			size: groupOptions.size,
			rounded: groupOptions.rounded,
			fillMode: groupOptions.fillMode,
			themeColor: groupOptions.themeColor
		});
		element.appendTo(that.element);
		buttons.push(that._addButton(element, item));
		if (item.selected) {
			that.selectedIndices.push(index);
		}
	});
	that._decorateButtons(buttons);
	return buttons;
};

This internal override is version-dependent. Verify that the affected ToolBar ButtonGroup configuration uses this method, and test selection, disabled states, and rendering. Keep item.attributes application-controlled and do not use encoded: false with untrusted button text; this override addresses URL attribute injection, not every possible source of unsafe markup.

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) and komyeonghane320f9 for their responsible disclosure and cooperation.

External References

CVE-2026-106159 (Medium)

CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7)

In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.811, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing whitespace and additional attributes, including an event handler, and execute JavaScript in a user's browser when the user interacts with the affected button. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

Finder Credits:

• Abhishek Nandkumar Bhaskar (Abhi-Hackz)
• komyeonghane320f9