Prototype Pollution Vulnerability in KendoReact by Progress Software

CVE-2026-106127

What is CVE-2026-106127?

A vulnerability exists in the setter utility of Progress Software's KendoReact library, specifically in versions ranging from 3.5.0 to 16.0.0. This issue allows a high-privileged attacker to exploit the field path provided to the utility. By manipulating this field path through components like Form, Scheduler, and Gantt, the attacker can alter the prototype of built-in objects in JavaScript, potentially leading to unauthorized access and modification of critical application properties. Users of the affected versions are recommended to assess the impact on their applications and apply any security patches released by the vendor to mitigate risks associated with this vulnerability.

References