Prototype Pollution in Kendo UI for Vue by Progress Software

CVE-2026-106128

What is CVE-2026-106128?

A prototype pollution vulnerability exists in Progress Software's Kendo UI for Vue that affects versions 0.4.0 through 9.2.0. This issue allows attackers with high privileges to manipulate the prototype of built-in objects via a controlled field path. As a result, attackers could leverage this flaw to introduce malicious modifications, potentially impacting the confidentiality, integrity, and availability of the application. Users are advised to review the vendor's advisory for further details and mitigation steps.

References