CVE-2026-106158 in Kendo UI for jQuery
Summary
by MITRE • 10/15/2026
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected event is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Progress Kendo UI for jQuery versions prior to 2026.3.1015 represents a critical input validation failure within the Scheduler component's rendering logic. Specifically, the Day, Timeline, Month, and Agenda views fail to properly encode resource color values when inserting them into quoted event wrapper attributes. This technical flaw allows an attacker who has control over the resource color data to inject arbitrary HTML attributes directly into the DOM structure of the rendered events. Because the input is not sanitized or encoded before being placed within attribute quotes, it bypasses standard browser security mechanisms that typically prevent script execution from static content injection points.
This specific implementation error leads to a Stored Cross-Site Scripting (XSS) vulnerability, categorized under CWE-79 in the Common Weakness Enumeration standards. The core issue lies in the lack of context-aware encoding for attribute values. When an attacker supplies a malicious payload such as a crafted color string that includes closing quotes and new HTML attributes with event handlers like onmouseover or onclick, the browser interprets these injected segments as executable JavaScript code rather than static data. Consequently, when a user interacts with the affected calendar event in any of the impacted views, the embedded script executes within the context of the victim's session.
The operational impact of this vulnerability is severe due to its potential for compromising both confidentiality and integrity. Since the malicious scripts execute in the browser environment where the application runs, they inherit the same privileges as legitimate application code. This allows attackers to perform actions such as stealing sensitive user data, including authentication tokens or personal information displayed within the scheduler interface. Furthermore, it enables unauthorized modifications to application state or data persistence mechanisms if those operations are accessible via client-side scripts. The ability to execute arbitrary JavaScript effectively breaks the isolation between trusted and untrusted content, undermining the security model of the web application.
From a threat modeling perspective aligned with MITRE ATT&CK techniques, this vulnerability facilitates initial access through phishing-like interactions where users might be tricked into clicking on specially crafted calendar events. It also supports credential harvesting and session hijacking scenarios by exfiltrating cookies or local storage data to an attacker-controlled server. The earliest affected version remains unconfirmed, but all versions up to 2026.3.811 are susceptible. To mitigate this risk, organizations must upgrade immediately to version 2026.3.1015 or later where the encoding logic has been corrected. Additionally, implementing Content Security Policy headers can provide a layer of defense-in-depth by restricting script execution sources, although upgrading remains the primary and most effective remediation strategy for this specific code-level flaw.