The vulnerability is a cross‑site scripting flaw in Progress Software Kendo UI for jQuery. The Badge text function renders bound data as raw HTML without encoding, allowing an attacker who can inject values into a Badge to place HTML that includes event handlers or script tags. When the Badge renders, the malicious code executes in the victim’s browser, potentially allowing the attacker to steal session data, read or modify application data, and tamper with content accessed through the application.

Applications built with Progress Software Kendo UI for jQuery versions starting with 2020.1.114 and earlier than 2026.3.1015 are vulnerable. Users deploying those releases should review their Badge implementations to confirm that any data bound to the Badge text comes from trusted or sanitized sources.

The CVSS score of 5.4 indicates moderate risk; the EPSS score of less than 1% reflects a low exploitation probability, and the vulnerability is not listed in CISA’s KEV catalogue. Successful exploitation requires an attacker to supply malicious data that is bound to a Badge, so the attack vector is likely through an application component that accepts user‑controlled input or through a compromised upstream data source. If this condition is met, arbitrary JavaScript can be executed in the victim’s browser, enabling data theft or manipulation.