Cross-Site Scripting Vulnerability in Kendo UI for jQuery by Progress
CVE-2026-106161

5.4MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
15 October 2026

What is CVE-2026-106161?

A cross-site scripting vulnerability exists in Progress® Kendo® UI for jQuery, where the Badge text method renders unencoded string values in HTML. This flaw allows attackers with the ability to modify data bound to a Badge to inject malicious HTML, which may execute JavaScript in the user's browser when the Badge is rendered. This can lead to the compromise of sensitive data and user actions within the application. The issue has been addressed in version 2026.3.1015.

Affected Version(s)

Kendo UI for jQuery 2020.1.114 < 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.