Prototype Pollution in Kendo UI for Angular by Progress Software

CVE-2026-106144

What is CVE-2026-106144?

A prototype pollution vulnerability exists in the Scheduler component of Kendo UI for Angular (specifically in @progress/kendo-angular-scheduler and @progress/kendo-angular-common) prior to version 25.1.0. This allows an attacker with high privileges to manipulate a field path managed by the Scheduler component, potentially enabling modification of the prototype for built-in JavaScript objects. While this results in a limited impact on confidentiality, integrity, and availability, it poses a security risk that should be addressed by updating to the latest version.

References