Cross-Site Scripting Vulnerability in Kendo UI for jQuery by Progress
CVE-2026-124696

7.1HIGH

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Jquery
Vendor
CVE Published:
12 November 2026

What is CVE-2026-124696?

A vulnerability exists in Kendo UI for jQuery affecting the Spreadsheet component, where sheet names are injected into the SheetsBar menu button's data-sheet-name attribute without necessary encoding. This flaw allows an attacker who can manipulate a sheet name to inject JavaScript via an event-handler attribute. When a user hovers over the menu button, this malicious script may execute, jeopardizing the confidentiality and integrity of any data present in the user's browser context. This issue affects versions 2024.4.1112 and 2026.3.1015, and it has been resolved in version 2026.4.1111.

Affected Version(s)

Kendo UI for jQuery 2024.4.1112 <= 2026.3.1015

References

https://www.telerik.com/kendo-jquery-ui/documentation/kno...
vendor-advisory

CVSS V3.1

Score:
7.1
Severity:
HIGH
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.