Progress Kendo UI for jQuery allows a model to accept server‑supplied data through Model.accept and then pass that data to kendo.setter without guarding against unsafe object paths such as __proto__, constructor or prototype. This enables an attacker who can supply acceptable data to the model to alter object prototype attributes, thereby affecting application logic and potentially exposing or modifying sensitive data. The consequences include compromise of confidentiality and integrity of application data, especially when the modified objects are used in server‑side JavaScript contexts. The vulnerability’s nature is a classic prototype‑pollution flaw (CWE‑1321).

The affected product is Kendo UI for jQuery from Progress Software. Any installation running a version earlier than 2026.3.1015 is vulnerable. The earliest impacted release has not been pinpointed, but all releases prior to 2026.3.1015 are susceptible.

The CVSS score of 5.4 indicates moderate severity, while an EPSS below 1% suggests a low likelihood of real‑world exploitation at the moment. The vulnerability is not listed in CISA’s KEV catalog, indicating no known widespread exploitation. The attack vector would require an attacker to supply data that the model accepts, which may be achievable through user input or manipulated API responses. Given the nature of prototype pollution, a successful exploitation could lead to arbitrary code execution within the JavaScript runtime if the application subsequently processes the polluted prototype. However, without confirmed exploitation scenarios, the risk remains moderate but non‑negligible.