Cross-Site Scripting Vulnerability in Progress® Kendo® UI for jQuery
CVE-2026-106158

4.7MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
15 October 2026

What is CVE-2026-106158?

In Progress Kendo UI for jQuery, versions up to 2026.3.811, a vulnerability exists in the Scheduler's Day, Timeline, Month, and Agenda views that allows an attacker to inject unauthorized HTML attributes through improperly encoded resource color values. This flaw can enable an attacker to execute JavaScript in a user's browser when they interact with the affected events, potentially compromising the confidentiality and integrity of sensitive data in the application. The issue has been resolved in version 2026.3.1015.

Affected Version(s)

Kendo UI for jQuery 2014.3.1119 < 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

komyeonghane320f9
.