CVE-2026-106149

medium

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation wit…

Vendor / product: Progress — kendo ui

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.

CVSS

5.4

5.4 (CVSS v3.1)

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Severity source: NVD CVSS v3.1 (security@progress.com)

Timeline (UTC)

Published: 2026-10-15 15:17

Modified: 2026-10-20 19:38

NVD status: Analyzed

Last synced 1 day ago

Verified against the source API 2026-10-27 07:03 UTC

Exploitation

Not listed in CISA KEV (as of last catalog sync)

Absence from KEV does not mean a CVE is not exploited. Exploitation status: unknown (no authoritative evidence in our sources).

Affected products

progress / kendo_ui ≥2011.2.804 <2026.3.1015

Weakness classification (CWE)

CWE-80

Source: NVD / CISA. “NVD-CWE-Other” and “NVD-CWE-noinfo” mean NVD could not assign a specific weakness.

Mitigation & advisories

Vendor advisory: https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-menu-xss-cve-2026-106149

References

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-menu-xss-... security@progress.com

Data sources

NVD CVE API 2.0 — fetched 2026-10-27 07:03 UTC · record ↗

Learn the basics

Understanding CVEs and CVSS Scores

CVE-2026-106149

Affected products

Weakness classification (CWE)

Mitigation & advisories

References

Data sources

Learn the basics

Related CVEs