A flaw in the PanelBar component of Kendo UI for jQuery allows an attacker to inject additional HTML attributes, including event handlers, into a single‑quoted href attribute that is derived from a data source item’s URL. The result is the execution of arbitrary JavaScript in the context of the victim’s browser, which can compromise the confidentiality and integrity of data accessed by the application. The flaw is rated as moderate (CVSS 4.7).

Progress Software’s Kendo UI for jQuery products are affected, specifically versions starting with 2019.2.514 and up to, but not including, 2026.3.1015. Any installation of the PanelBar component within that version range that accepts user‑controlled URLs is vulnerable.

The vulnerability carries a CVSS score of 4.7, indicating moderate severity, and an EPSS score below 1 %, signifying a very low probability of exploitation at any given moment. It is not listed in the CISA KEV catalog. The attack vector requires that an attacker be able to supply a malicious URL to the PanelBar data source; once supplied, the payload will execute when the user interacts with the affected item. Because the flaw is uncontrolled input rendering, it is exploitable by any user of the application who can influence those URLs, such as through form input or a data feed.