CVE-2026-106149 in Kendo UI for jQuery
Summary
by MITRE • 10/15/2026
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Progress Kendo UI for jQuery prior to version 2026.3.1015 represents a critical server-side input validation failure within the Menu component that leads to cross-site scripting through attribute injection. This flaw stems from an insecure coding practice where HTML attributes are constructed via direct string concatenation of values bound to data source fields, without implementing proper neutralization or encoding mechanisms. In modern web application development, particularly when using client-side frameworks like Kendo UI, it is imperative that any user-controlled input intended for attribute values undergoes rigorous sanitization before being rendered into the DOM. The absence of such safeguards allows an attacker who possesses low-level privileges capable of manipulating these bound data fields to inject malicious JavaScript event-handler attributes directly into the HTML structure generated by the Menu component.
From a technical perspective, this vulnerability aligns with CWE-79, which classifies improper neutralization of input during web page generation as cross-site scripting. The specific mechanism here involves the injection of event handlers such as onmouseover or onclick, rather than simple script tags embedded in text content. When an end-user interacts with the affected Menu element by hovering over items or clicking them, the browser interprets the injected attribute as executable JavaScript code within the context of the vulnerable application. This execution occurs entirely client-side, leveraging the trust that browsers place in scripts originating from the same domain as the web page itself. The attacker does not need to execute arbitrary server-side commands but rather exploits the user's active session and browsing environment to perform actions on their behalf or exfiltrate sensitive information stored locally within the browser context.
The operational impact of this vulnerability is significant, primarily affecting the confidentiality and integrity aspects of the security triad for users interacting with the compromised interface. Because the malicious script executes in the victim’s browser context, it has access to all cookies, local storage data, session tokens, and other sensitive information associated with that domain. An attacker can utilize this capability to steal authentication credentials, hijack user sessions, or perform unauthorized actions such as modifying account settings or initiating financial transactions if those functions are accessible through the application interface. Furthermore, since the vulnerability requires only low privileges for exploitation, it lowers the barrier to entry for attackers, making it a viable threat vector against applications where even basic users can influence data source fields used by UI components like menus.
This attack scenario is consistent with MITRE ATT&CK technique T1059, specifically sub-technique 007 which covers JavaScript execution in web browsers. The exploitation path typically involves the attacker first gaining access to a privileged or semi-privileged account within the application to modify data source fields, followed by luring an administrator or high-value user into interacting with the manipulated menu item. Once interaction occurs, the injected script runs silently, potentially sending stolen session cookies back to an external server controlled by the attacker. This enables persistent unauthorized access without requiring further exploitation steps against the underlying infrastructure, highlighting the importance of securing client-side rendering logic as much as backend API endpoints.
To mitigate this vulnerability, developers must ensure that all dynamic content used in HTML attributes is properly encoded before being rendered into the DOM. Progress has addressed this issue by updating the Menu component to implement robust neutralization strategies for bound data fields. For organizations still running older versions of Kendo UI for jQuery, immediate upgrading to version 2026.3.1015 or later is strongly recommended as the primary remediation step. Additionally, implementing Content Security Policy headers can provide an additional layer of defense by restricting the sources from which scripts are allowed to execute, thereby mitigating the impact even if similar vulnerabilities exist in other components. Regular security code reviews focusing on string concatenation practices and input validation logic should also be conducted to prevent recurrence of such injection flaws across the application stack.