In the affected calendar components of the Kendo UI for jQuery library, data passed to month content templates is rendered without proper sanitization. This flaw allows an attacker to inject a JavaScript URL or event–handler attributes into the rendered output, enabling the execution of arbitrary code in the browser context when a user interacts with the calendar. The resulting code runs with the privileges of the page and can therefore read and alter any data that the page can access, thereby compromising its confidentiality and integrity.

Progress Software’s Kendo UI for jQuery Calendar and MultiViewCalendar components are affected. Any installation of the library released before version 2026.3.1015 contains the vulnerable code paths and must be considered at risk.

The vulnerability has a CVSS score of 5.4, indicating a medium severity impact, and an EPSS score of less than 1 percent, showing a low likelihood of exploitation. It is not listed in the CISA KEV catalog. Because the flaw requires an attacker to supply controlled URL values or culture‑derived title strings, the required privilege is low and can be achieved by an attacker who can influence the configuration or input of the calendar. Once triggered, the attack would allow client‑side code execution within the user's browser, potentially exposing sensitive data or enabling further compromise.