← Back

CVE-2026-106149

nvd nist
Published: Oct 15, 2026Modified: Oct 20, 2026

JSON object

Loading...
5.4
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Exploitability: 2.3 / Impact: 2.7
Source: security@progress.com (Secondary)

Description

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.

Affected (1)

Products: Progress: Kendo Ui
Progress
1 product
Kendo Ui
Configuration A
1 vulnerable
Vulnerable SoftwareAffected Versions
Kendo Ui
2011.2.804 ≤ version < 2026.3.1015

Related CWEs

CWE-80
Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

References (1)

Source: security@progress.com
Vendor Advisory

Timeline

No history available yet.