Cross-Site Scripting Vulnerability in Progress Kendo UI for jQuery
CVE-2026-106157

4.7MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
15 October 2026

What is CVE-2026-106157?

The Kendo UI for jQuery PanelBar component has a vulnerability due to improper encoding of URL values inserted into a single-quoted href attribute. This flaw allows an attacker to manipulate item URLs to inject additional HTML attributes, including event handlers. As a result, executing JavaScript in the user's browser upon interaction with the affected item can compromise both confidentiality and integrity of sensitive data. Users are advised to upgrade to version 2026.3.1015 or later to mitigate this security risk.

Affected Version(s)

Kendo UI for jQuery 2019.2.514 < 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

komyeonghane320f9
.