XSS Vulnerability in Progress Kendo UI for jQuery Button Group URLs

CVE-2026-106159

What is CVE-2026-106159?

In Progress Kendo UI for jQuery, the ToolBar ButtonGroup functionality contains a vulnerability wherein button URLs are improperly handled. Specifically, versions from 2022.3.1109 up to, but not including, 2026.3.1015 are affected by an issue where URL sanitization leads to concatenated unquoted href attributes. An attacker with control over a button URL may exploit this flaw by injecting malicious HTTPS URLs that include whitespace and additional attributes, enabling the execution of arbitrary JavaScript within a user's browser upon interaction with the button. This exploitation can significantly compromise the confidentiality and integrity of sensitive data accessed within the affected application. The issue has been addressed in version 2026.3.1015.

References