Cross-Site Scripting Vulnerability in Kendo UI for jQuery by Progress Software
CVE-2026-106151

5.4MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
15 October 2026

What is CVE-2026-106151?

The Kendo UI for jQuery framework has a vulnerability that allows attackers to inject malicious HTML through manipulated validation messages. When these messages are decoded and parsed as HTML, they can include active markup and event handlers. This exploitation enables the execution of JavaScript in the user's browser, potentially compromising sensitive data accessed by the affected application. The vulnerability has been addressed in version 2026.3.1015 to mitigate these risks.

Affected Version(s)

Kendo UI for jQuery 2012.2.710 < 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.