Cross-Site Scripting Vulnerability in Kendo UI for jQuery by Progress

CVE-2026-124693

What is CVE-2026-124693?

A cross-site scripting vulnerability exists in Progress Kendo UI for jQuery, where axis field names in the PivotGrid and PivotConfigurator are passed to a chip template without adequate encoding. This flaw allows attackers to manipulate field names, leading to potential execution of arbitrary JavaScript within user browsers. Such exploitation can jeopardize sensitive data by exposing it through the user's browser context, emphasizing the need for proper encoding and sanitization of user inputs in web applications.

References