Code Injection Vulnerability in Kendo UI for jQuery by Telerik
CVE-2026-124686

5.4MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
11 November 2026

What is CVE-2026-124686?

The Kendo UI for jQuery framework contains a code injection vulnerability that affects earlier versions than 2026.4.1111. This issue arises when the kendo.init() function processes data-attribute values, allowing attackers with limited privileges to inject malicious JavaScript code through improperly controlled attribute values. When a page is loaded or interacted with, this injected code can execute, potentially compromising the confidentiality and integrity of sensitive user data in the browser. It is crucial for users to update to the latest version to mitigate this risk.

Affected Version(s)

Kendo UI for jQuery 2022.3.1109 < 2026.4.1111

Kendo UI for jQuery 2026.4.1111

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.