Description
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.
Published: 2026-10-15
Score: 5.4 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross-site scripting that enables arbitrary JavaScript execution in the user's browser context, providing access to confidential data and potentially modifying data integrity
Action: Patch
AI Analysis

Impact

The vulnerability resides in the Menu component of Progress' Kendo UI for jQuery and occurs when the component builds HTML attributes by concatenating bound dataSource fields. An attacker who can influence these fields can inject JavaScript event‑handler attributes. When a user interacts with the affected Menu, the injected code runs within the user's browser, compromising confidentiality and integrity of the data visible to that browser session.

Affected Systems

This issue affects all releases of Progress Software's Kendo UI for jQuery prior to version 2026.3.1015, specifically the Menu component.

Risk and Exploitability

The CVSS score of 5.4 indicates a moderate severity, while the EPSS score of less than 1% suggests a low chance of exploitation. The vulnerability is not listed in CISA's KEV catalog. An attacker with low privileges who can control bound dataSource fields is the likely threat actor; the attack requires no special network access and relies on user interaction with the Menu component.

Generated by OpenCVE AI on October 16, 2026 at 21:07 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade to Kendo UI for jQuery version 2026.3.1015 or later to apply the vendor’s fix that sanitizes the constructed HTML attributes.
  • If upgrading is not immediately possible, sanitize or encode any data that is bound to the Menu component’s dataSource to strip or escape event‑handler attributes before they are rendered.
  • Enforce proper access controls so that only authorized users can supply data that will be rendered by the Menu component, limiting the ability of low‑privilege users to inject malicious content.

Generated by OpenCVE AI on October 16, 2026 at 21:07 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 19:45:00 +0000

Type Values Removed Values Added
First Time appeared Progress kendo Ui
CPEs cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*
Vendors & Products Progress kendo Ui

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Progress
Progress kendo Ui For Jquery
Vendors & Products Progress
Progress kendo Ui For Jquery

Thu, 15 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
Description In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.
Title Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Weaknesses CWE-80
References
Metrics cvssV3_1

{'score': 5.4, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Progress Kendo Ui Kendo Ui For Jquery
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-15T18:13:44.008Z

Reserved: 2026-10-06T15:51:11.738Z

Link: CVE-2026-106149

cve-icon Vulnrichment

Updated: 2026-10-15T18:13:37.237Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T15:17:21.843

Modified: 2026-10-20T19:38:55.830

Link: CVE-2026-106149

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T14:01:13Z

Weaknesses
  • CWE-80

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)