Prototype Pollution occurs in the Scheduler component of Progress Software Kendo UI for Angular when a field path supplied by a high‑privileged attacker is processed. This flaw is a CWE-1321 weakness. By manipulating that path, the attacker can alter the prototype of built‑in JavaScript objects, causing unintended behavior in the application. The impact is limited to a modest compromise of confidentiality, integrity, and availability, as the vulnerability does not provide direct arbitrary code execution or system compromise.

All installations of Progress Software Kendo UI for Angular that rely on the Scheduler component (specifically @progress/kendo-angular-scheduler and @progress/kendo-angular-common) with a version earlier than 25.1.0 are vulnerable. Users deploying these packages in any environment are potentially exposed.

The CVSS score of 4.1 indicates a moderate overall severity, and because the EPSS score is not available, the current probability of exploitation cannot be quantified. The vulnerability is not listed in CISA’s KEV catalog, suggesting no publicly known exploits at present. The attack requires an attacker to have control over the field path data processed by the Scheduler, implying a need for elevated privileges within the application context. Given these constraints, the risk remains limited but it is still prudent to address the issue promptly.