Cross-Site Scripting Vulnerability in Kendo UI for jQuery by Progress

CVE-2026-106150

What is CVE-2026-106150?

The Kendo UI for jQuery framework by Progress has a vulnerability that allows for Cross-Site Scripting (XSS) attacks via the Splitter, Window, and Tooltip components. Specifically, these components construct iframe markup without properly sanitizing the URL values or encoding the Window iframe titles. This oversight permits an attacker with limited privileges to inject HTML attributes, including JavaScript event handlers, by manipulating iframe URLs or crafted titles. When end-users interact with the compromised components, the injected code can execute within their browsers, potentially exposing sensitive data and undermining the security of web applications relying on this framework.

References