Description
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected event is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
Published: 2026-10-15
Score: 4.7 Medium
EPSS: < 1% Very Low
KEV: No
Impact: Cross‑Site Scripting
Action: Apply Patch
AI Analysis

Impact

The vulnerability in Progress Kendo UI for jQuery permits an attacker who controls a resource color value to embed malicious HTML attributes and JavaScript into event wrapper attributes, enabling script execution in a victim’s browser when the event is interacted with. This cross‑site scripting can lead to compromise of the confidentiality and integrity of application data accessible to the affected environment.

Affected Systems

The issue affects Progress Software’s Kendo UI for jQuery, specifically versions 2026.3.811 and earlier. Progress has confirmed a fix in release 2026.3.1015.

Risk and Exploitability

The CVSS score of 4.7 indicates a moderate severity, and the EPSS score of less than 1 % signals a very low probability of exploitation at present. The vulnerability is not listed in the CISA KEV catalog. Successful exploitation requires an attacker to influence the selection of a resource color, so the risk is mitigated by restricting that control to trusted users or by sanitizing the input before it is rendered.

Generated by OpenCVE AI on October 16, 2026 at 21:48 UTC.

Remediation

No solution or workaround provided in the CVE record.

OpenCVE Recommended Actions

  • Upgrade Kendo UI for jQuery to version 2026.3.1015 or later.
  • If an upgrade cannot be performed, configure the application so that only administrators or a dedicated role can set resource colors to prevent malicious input.
  • Implement input validation to ensure color strings contain only valid CSS color syntax before embedding them in HTML attributes.

Generated by OpenCVE AI on October 16, 2026 at 21:48 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Tue, 20 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
First Time appeared Progress kendo Ui
CPEs cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*
Vendors & Products Progress kendo Ui

Mon, 19 Oct 2026 14:30:00 +0000

Type Values Removed Values Added
First Time appeared Progress
Progress kendo Ui For Jquery
Vendors & Products Progress
Progress kendo Ui For Jquery

Thu, 15 Oct 2026 19:30:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Thu, 15 Oct 2026 13:45:00 +0000

Type Values Removed Values Added
Description In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected event is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
Title Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery
Weaknesses CWE-80
References
Metrics cvssV3_1

{'score': 4.7, 'vector': 'CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N'}

Subscriptions

Progress Kendo Ui Kendo Ui For Jquery
cve-icon MITRE

Status: PUBLISHED

Assigner: ProgressSoftware

Published:

Updated: 2026-10-15T18:29:15.316Z

Reserved: 2026-10-06T15:51:14.432Z

Link: CVE-2026-106158

cve-icon Vulnrichment

Updated: 2026-10-15T18:29:10.942Z

cve-icon NVD

Status : Analyzed

Published: 2026-10-15T14:17:14.483

Modified: 2026-10-20T19:21:09.810

Link: CVE-2026-106158

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-10-19T14:01:31Z

Weaknesses
  • CWE-80

    Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)