Progress Software’s Kendo UI for jQuery components TabStrip, Menu, and PanelBar insert imageUrl values directly into single‑quoted image src attributes without escaping. This flaw allows an attacker who can control the image URL to inject additional HTML attributes, such as event handlers, that result in arbitrary JavaScript execution in a victim’s browser. Successful exploitation can lead to the theft or alteration of data accessible to the application.

All installations of Kendo UI for jQuery version prior to 2026.3.1015. The earliest affected version is not confirmed, so any deployment before the 2026.3.1015 release should be reviewed.

The CVSS score of 5.4 indicates a moderate severity vulnerability. The EPSS score of < 1% suggests that the likelihood of exploitation is currently low, and the vulnerability is not listed in the CISA KEV catalog. Attackers can exploit this flaw by providing a malicious imageUrl in a data source that the component renders, which could be achieved through user‑controlled inputs or compromised data stores. The vulnerability permits attackers to run arbitrary JavaScript in the context of the affected application, potentially accessing or modifying sensitive data.