CVE-2026-106160 in Kendo UI for jQuery
Summary
by MITRE • 10/15/2026
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Progress Kendo UI for jQuery prior to version 2026.3.1015 represents a critical instance of prototype pollution, specifically categorized under CWE-1321 as Improperly Controlled Modification of Object Prototype Attributes. This flaw resides within the Model.accept method, which is responsible for processing server responses and updating model state in client-side applications. The core technical deficiency lies in the lack of input sanitization when passing keys from the server response to the kendo.setter function. By failing to validate or escape property names that contain dangerous identifiers such as _proto_, constructor, or prototype, the library inadvertently allows an attacker to inject properties directly into the JavaScript Object.prototype object. This mechanism bypasses standard inheritance chains and modifies the base template for all objects created within the application runtime environment.
The operational impact of this vulnerability is severe because it enables remote code execution scenarios depending on how the affected application utilizes the polluted prototypes. When an attacker successfully supplies data containing these unsafe paths, they can alter fundamental behaviors expected by the JavaScript engine or subsequent library functions that rely on standard object properties. For instance, modifying the prototype chain can lead to unauthorized access to sensitive user data stored in objects, thereby compromising confidentiality. Furthermore, if the application logic depends on specific property values for security checks or business rules, these modifications can bypass authentication mechanisms or alter authorization decisions, leading to integrity violations. In server-side JavaScript environments where similar patterns might be replicated or mirrored through shared libraries, the impact could extend beyond client-side manipulation to affect backend processing logic as well.
From a threat intelligence perspective, this vulnerability aligns with ATT&CK technique T1504.003, specifically Weakly Stored Objects, and relates to injection techniques that exploit dynamic property access patterns common in JavaScript frameworks like Kendo UI. The attack vector typically involves an attacker controlling or influencing the data returned by the server endpoint associated with the model update process. This could be achieved through compromised API endpoints, malicious third-party integrations, or if the application allows user input to directly influence server responses without proper validation on the backend before transmission. The earliest affected version remains unconfirmed, suggesting that this issue may have persisted across multiple releases until the specific patch was deployed in 2026.3.1015.
Mitigation strategies must focus on both immediate remediation and long-term defensive coding practices. The primary solution is to upgrade immediately to Progress Kendo UI for jQuery version 2026.3.1015 or later, where the developers have implemented safeguards against unsafe object paths in the Model.accept method. For applications unable to update immediately due to compatibility constraints, a temporary workaround involves implementing custom validation logic on the server side to ensure that no response keys contain _proto_, constructor, or prototype before they are sent to the client. Additionally, integrating Content Security Policy headers can help mitigate some downstream effects by restricting script execution contexts, although this does not address the root cause of the prototype pollution itself. Developers should also adopt static analysis tools configured to detect unsafe property assignment patterns and enforce strict input validation protocols for all data originating from external sources or server responses within JavaScript-based applications.