A prototype‑pollution flaw exists in the @progress/kendo‑vue‑common library of Progress Software Kendo UI for Vue. An attacker who can supply a controlled field path used by components such as the Scheduler can inject properties into the prototypes of native JavaScript objects. This manipulation can modify application behavior and introduce errors, but the reported consequences are confined to restricted impacts on confidentiality, integrity, and availability.

Progress Software Kendo UI for Vue is affected. Versions from 0.4.0 through 9.2.0 are vulnerable. Applications that incorporate any of these library versions, especially those that expose Scheduler functionality or otherwise accept user‑supplied field paths, must be considered at risk.

The CVSS score of 4.1 indicates moderate severity. The exploitability depends on the attacker’s privilege level; a high‑privileged attacker who can influence the field path can trigger the pollution. EPSS information is not available and the vulnerability is not listed in CISA’s KEV catalog, suggesting currently no widespread exploitation reports. Still, the risk remains due to the potential to alter prototype behavior within the application context.