Prototype pollution was discovered in the setter utility of Progress Software's KendoReact library. This flaw (CWE‑1321) allows an attacker who can control the field path argument to alter the prototype of built‑in JavaScript objects. The consequent data structure changes may affect the application’s behavior, but only a modest compromise of confidentiality, integrity, and availability is expected.

The affected products are Progress Software KendoReact versions 3.5.0 through 16.0.0, including components such as the Form, Scheduler, and Gantt that call the vulnerable utility.

The CVSS score is 4.1, indicating low‑to‑medium severity. EPSS data is unavailable, and the vulnerability is not listed in CISA KEV, suggesting a lower likelihood of widespread exploitation. The likely attack vector requires a high‑privileged attacker who can supply a malicious field path, often through user‑facing forms or components. Because the exploits affect only prototype objects and not directly private data, the overall risk is moderate with limited impact.