XSS Vulnerability in Kendo UI for jQuery Affects Telerik Products
CVE-2026-106148

5.4MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
15 October 2026

What is CVE-2026-106148?

A vulnerability exists in Telerik's Kendo UI for jQuery versions prior to 2026.3.1015, where components such as TabStrip, Menu, and PanelBar improperly handle image source URLs. This oversight allows attackers to inject additional HTML attributes, including event handlers, into the src attribute of images. When a user interacts with the affected component, malicious JavaScript may execute in their browser, potentially compromising user data confidentiality and integrity. The issue is resolved in version 2026.3.1015.

Affected Version(s)

Kendo UI for jQuery 2011.2.804 < 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
komyeonghane320f9
HanTul
.