CVE-2026-106153 in Kendo UI for jQuery
Summary
by MITRE • 10/15/2026
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Progress Kendo UI for jQuery versions prior to 2026.3.1015 represents a critical client-side security flaw rooted in insufficient input validation and output encoding within the Calendar and MultiViewCalendar components. This issue specifically affects how these widgets render data derived from URL parameters or culture-specific title values into HTML content templates. The core technical failure lies in the absence of proper sanitization for URLs and inadequate HTML attribute encoding when processing dynamic inputs. When an application utilizes these UI components to display calendar events, it often passes user-controllable or server-generated data directly into template strings without rigorous filtering. This lack of robust encoding allows malicious payloads to bypass standard security controls that would typically neutralize script execution in a browser environment.
An attacker with low privileges who has the ability to influence the URL option or manipulate culture-derived title values can exploit this weakness to execute arbitrary JavaScript code within the victim's browser context. By injecting a JavaScript URI into a link element or by crafting event-handler attributes such as onmouseover or onclick, the adversary can trigger script execution upon user interaction with the calendar interface. This type of attack is particularly dangerous because it does not require administrative access; instead, it leverages social engineering or automated interactions to trick users into triggering the malicious code simply by viewing or interacting with a compromised calendar view. The resulting cross-site scripting allows for session hijacking, credential theft, and unauthorized actions performed on behalf of the victim.
The operational impact of this vulnerability extends beyond simple script execution, affecting both the confidentiality and integrity of accessible data within the application. Once JavaScript is executed in the user's context, an attacker can access sensitive cookies, local storage items, or other authentication tokens that are not marked as HttpOnly. This compromise enables the exfiltration of confidential information to external servers controlled by the attacker. Furthermore, the ability to modify page content dynamically allows for phishing attacks where fake login forms or deceptive messages are injected into the legitimate application interface, further eroding user trust and potentially leading to broader credential compromises across integrated systems that share authentication states.
From a classification perspective, this vulnerability aligns with CWE-79, which describes Improper Neutralization of Input During Web Page Generation commonly known as Cross-site Scripting (XSS). Specifically, it falls under the subcategory of stored or reflected XSS depending on how the malicious input is persisted and served to users. In terms of offensive security frameworks, this exploit maps directly to MITRE ATT&CK technique T1059, Command and Control via Browser-based Execution, specifically leveraging JavaScript for initial access and potentially lateral movement if combined with other vulnerabilities. The attack vector relies heavily on user interaction, categorizing it under the Initial Access tactics where social engineering or诱骗 techniques are employed to execute code in a trusted environment.
To mitigate this risk, organizations must immediately upgrade Progress Kendo UI for jQuery to version 2026.3.1015 or later, which includes patches addressing these sanitization and encoding deficiencies. For environments unable to patch immediately, implementing strict Content Security Policy headers can help restrict the sources from which scripts are allowed to execute, thereby reducing the impact of successful injection attempts. Additionally developers should ensure that all dynamic data rendered into HTML templates is properly encoded using context-aware escaping functions provided by the framework or third-party libraries like DOMPurify. Input validation on both client and server sides must be enforced to reject any URLs containing javascript: schemes or unexpected special characters in title fields before they reach the rendering engine, ensuring that only safe, expected data structures are processed for display.