CVE-2026-106162 in Kendo UI for jQuery
Summary
by MITRE • 10/15/2026
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 10/15/2026
The vulnerability identified in Progress Kendo UI for jQuery represents a classic instance of Cross-Site Scripting, specifically categorized under CWE-79: Improper Neutralization of Input During Web Page Generation. This flaw resides within the FileManager component and affects versions starting from 2023.3.1010 up to, but not including, version 2026.3.1015. The core technical issue stems from an inconsistency in how user-supplied data is processed for different rendering contexts. While list items displaying file names are correctly encoded to prevent script execution, the drag hint feature renders these same item names as raw HTML without adequate sanitization or encoding. This discrepancy creates a specific attack vector where malicious actors can exploit the less secure context of the drag interaction rather than the primary display area.
From an operational perspective, this vulnerability allows for Stored Cross-Site Scripting if the file name is persisted on the server side before being retrieved and rendered by the client application. An attacker who gains the ability to control or influence the naming convention of files within the managed directory can inject HTML payloads containing event handlers such as onload or onclick attributes. When a legitimate user interacts with the interface by dragging an affected item, the browser parses the drag hint's content as executable code rather than plain text. This results in the immediate execution of arbitrary JavaScript within the context of the victim’s session and domain.
The impact of this exploitation is significant regarding both confidentiality and integrity. Because the script executes in the user's browser with their authentication tokens and cookies, an attacker can perform actions on behalf of the victim without their knowledge or consent. This includes exfiltrating sensitive data visible within the application, modifying file metadata, deleting files, or redirecting the user to malicious external sites. The attack aligns with MITRE ATT&CK technique T1059.007: JavaScript, which describes how attackers use browser-based scripting languages to execute commands and manipulate web applications. It also relates to T1204.002: Malicious File, as the vector involves tricking a user into interacting with a file name that serves as a payload carrier.
Mitigation strategies should prioritize immediate upgrading of the Kendo UI library to version 2026.3.1015 or later, where this rendering inconsistency has been resolved by ensuring consistent encoding across all components including drag hints. For organizations unable to patch immediately due to dependency constraints, implementing a Content Security Policy (CSP) can provide a layer of defense-in-depth. Specifically, restricting the sources from which scripts can be loaded and disabling inline script execution via nonce-based or hash-based CSP directives can prevent the injected event handlers from running even if they are rendered in the DOM. Additionally, input validation should be enforced at the application level to reject file names containing special HTML characters such as angle brackets, quotes, and ampersands before they are stored in the backend storage system.