Cross-Site Scripting Issue in Kendo UI for jQuery by Progress
CVE-2026-106147

5.4MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
15 October 2026

What is CVE-2026-106147?

The Kendo UI for jQuery library has a Cross-Site Scripting (XSS) vulnerability due to the ListBox default item template rendering bound dataTextField values as raw HTML without proper encoding. This flaw allows attackers to inject malicious HTML containing event handlers, leading to arbitrary JavaScript execution in the user's browser when a compromised list item is displayed. The risk is significant as it can affect the confidentiality and integrity of sensitive data. This issue has been addressed in version 2026.3.1015.

Affected Version(s)

Kendo UI for jQuery 2020.1.114 < 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.