Prototype Pollution Vulnerability in Progress® Kendo® UI for jQuery

CVE-2026-106160

What is CVE-2026-106160?

A vulnerability exists in Progress® Kendo® UI for jQuery that allows attackers to manipulate object prototype attributes through the Model.accept function. This is due to insufficient validation of server-response keys, which can include unsafe object paths like proto, constructor, or prototype. When exploited, this vulnerability can enable an attacker to alter application behavior and potentially compromise the confidentiality and integrity of sensitive data. The risk is especially pronounced in environments where modified objects are utilized, including server-side JavaScript applications. The vulnerability has been addressed in the release of version 2026.3.1015.

References