The vulnerability arises because the Validator component decodes validation messages supplied through data-msg-* attributes and then parses those messages as HTML. An attacker who can alter a validation message—such as by injecting malicious content through a user input field—can cause escaped HTML to be interpreted as active markup when the user triggers validation. The resulting JavaScript is executed in the victim’s browser, enabling theft of confidential data, session hijacking, or defacement of the application. This flaw falls under CWE-80, an XSS weakness that can compromise confidentiality and integrity of data accessible to the application.

The affected product is Progress Software’s Kendo UI for jQuery. Versions from 2012.2.710 through any release prior to 2026.3.1015 are vulnerable. Updates beginning with 2026.3.1015 contain a fix that stops the Validator from parsing untrusted validation messages as HTML.

With a CVSS score of 5.4 the vulnerability is considered medium severity. The EPSS score of less than 1% indicates a very low probability of exploitation in the wild, and the issue is not listed in CISA’s KEV catalog. Nonetheless, an attacker who can influence a validation message can trigger client‑side script execution, a potentially powerful vector if the application handles sensitive user data. The attack primarily requires the ability to write a custom validation message, which may occur through compromised input fields or by social engineering a user into submitting crafted data.