The vulnerability arises when ToolBar ButtonGroup button URLs are appended directly to an unquoted href attribute after URL sanitization. An attacker who can influence the button URL can insert an otherwise allowed HTTPS URL that includes whitespace and additional attributes such as an event handler, allowing execution of arbitrary JavaScript when the button is clicked. This client‑side code execution can lead to disclosure of protected data and unauthorized manipulation of data accessed by the application. The attack is limited to the context of the browser and does not allow direct code execution on the server.

Progress Software Kendo UI for jQuery versions from 2022.3.1109 up to and including 2026.3.1014 are affected. The issue was addressed in the 2026.3.1015 release.

The CVSS score of 4.7 indicates a moderate severity, while the EPSS score of less than 1% suggests a low probability of widespread exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires an attacker to supply a crafted button URL and for the target user to interact with that button. Therefore, the primary risk is to the confidentiality and integrity of data in the client's browser session. Mitigating this risk involves preventing the use of unsanitized URLs or applying appropriate safeguards such as a content security policy.