CVE-2026-106134 in KendoReact
Summary
by MITRE • 11/06/2026
Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 11/06/2026
The vulnerability identified as Cross-Site Scripting within the Progress Software KendoReact Menu component represents a significant security risk for web applications utilizing versions 1.3.0 through 16.1.0 of the @progress/kendo-react-layout package. This flaw stems from an improper neutralization of special elements used in script, specifically involving how user-supplied or attacker-influenced data is rendered within menu items. When a developer integrates this component into their application and allows external inputs to determine the content of menu entries, such as navigation links or action triggers, the library fails to adequately sanitize unsafe URLs before rendering them. Consequently, if an attacker can manipulate the data structure passed to the Menu component to include malicious JavaScript code disguised within a URL property, that script is executed directly in the context of the victim user's browser session when they interact with the compromised menu item.
From a technical perspective, this vulnerability aligns closely with CWE-79, which classifies Improper Neutralization of Input During Web Page Generation known as Cross-site Scripting. The specific mechanism involves the injection of executable scripts via URL parameters or href attributes that are not properly escaped or validated by the component's internal rendering logic. Unlike stored XSS where malicious content is saved to a database and served later, this vulnerability can manifest in scenarios involving reflected inputs or dynamically generated menus based on user roles or preferences. The execution context is critical here because the script runs with the same privileges as legitimate application scripts, granting it access to cookies, session tokens, local storage, and other sensitive data associated with the current domain origin. This capability allows for a complete compromise of client-side security boundaries established by the Same-Origin Policy.
The operational impact of this vulnerability is severe, particularly in applications where menu structures are partially or fully controlled by users with lower privilege levels. An attacker who can influence menu item data could craft a malicious link that, upon being clicked by an administrator or another high-privileged user, triggers arbitrary JavaScript execution. This enables actions such as session hijacking through the theft of authentication cookies, credential harvesting via fake login forms injected into the page DOM, keylogging to capture sensitive input, or performing unauthorized state-changing requests on behalf of the victim. In enterprise environments using KendoReact for complex dashboards and administrative interfaces, this could lead to full account takeover, data exfiltration, or further lateral movement within the application if combined with other vulnerabilities like CSRF.
Mitigation strategies must address both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade the @progress/kendo-react-layout package to a version that includes patches for this vulnerability, ensuring that all instances of KendoReact are updated consistently across the project dependencies. For applications unable to immediately patch due to compatibility constraints or release cycles, developers should implement strict input validation and output encoding on any data used to populate menu items before it reaches the component. Utilizing React's built-in JSX escaping mechanisms is insufficient for URL attributes in some contexts, so explicit sanitization libraries like DOMPurify should be employed to strip dangerous scripts from URLs before they are assigned to props. Additionally, implementing Content Security Policy headers can help mitigate the impact by restricting script execution sources and preventing inline script injection even if the vulnerability is exploited. Regular security audits of third-party component usage and adherence to OWASP guidelines for input validation will further reduce the attack surface associated with dynamic UI components like menus.