Description
Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.
Published: 2026-11-06
Score: 5.4 Medium
EPSS: n/a
KEV: No
Impact: Cross‑Site Scripting that enables execution of arbitrary JavaScript in the application origin
Action: Apply patch
AI Analysis

Impact

Cross‑Site Scripting was discovered in the Menu component (@progress/kendo-react-layout) of Progress Software KendoReact. The flaw allows a low‑privileged attacker who can influence the menu item data to provide an unsafe URL that, when a user selects the menu item, causes arbitrary JavaScript to run in the origin of the application.

Affected Systems

Progress Software KendoReact, versions 1.3.0 through 16.1.0, are vulnerable. The issue applies to the @progress/kendo-react-layout Menu component in any application that includes these versions.

Risk and Exploitability

The vulnerability carries a CVSS score of 5.4, indicating moderate severity. EPSS is not available, and the issue is not listed in the CISA KEV catalog. Exploitation requires a low‑privileged attacker who can supply or influence the Menu item data, typically through user input or a compromised data source. Since the exploit occurs when a user selects the menu item, the attack vector is primarily client‑side and hinges on the presence of a crafted URL. The low exploitation probability does not eliminate the threat to applications that rely on untrusted data for menu items.

Generated by OpenCVE AI on November 6, 2026 at 19:03 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade KendoReact to a version newer than 16.1.0 where the Menu component’s URL handling has been fixed.
  • Sanitize or encode any URLs before passing them to the Menu component so that the browser treats them as plain text.
  • Implement a strong Content‑Security‑Policy that disallows inline script execution and restricts script sources to trusted origins.
  • Validate or whitelist allowed URL schemes for menu items to prevent arbitrary JavaScript execution.

Generated by OpenCVE AI on November 6, 2026 at 19:03 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Fri, 06 Nov 2026 19:00:00 +0000

Type Values Removed Values Added
First Time appeared Progress
Progress kendoreact
Vendors & Products Progress
Progress kendoreact

Fri, 06 Nov 2026 17:00:00 +0000

Type Values Removed Values Added
Description Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.
Title Cross-Site Scripting in Progress Software KendoReact
Weaknesses CWE-79
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Progress Kendoreact
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-11-06T17:46:14.003Z

Reserved: 2026-10-06T15:51:08.623Z

Link: CVE-2026-106134

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Awaiting Analysis

Published: 2026-11-06T17:17:11.783

Modified: 2026-11-06T20:38:53.570

Link: CVE-2026-106134

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-11-06T19:15:08Z

Weaknesses
  • CWE-79

    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')