The vulnerability arises when the FileManager component renders item names supplied by a remote source as raw HTML in its default drag hint. The component does not properly encode these names even though the list items themselves are encoded. When an attacker can influence an item name – for example by uploading a file, renaming an entry, or inserting a malicious object – they can embed HTML that includes event handlers. When a user drags the affected item, the injected JavaScript executes in that user’s browser, allowing the attacker to read or alter data within the application domain.

Progress Software Kendo UI for jQuery, versions 2023.3.1010 through 2026.3.1014 inclusive; the issue is fixed in 2026.3.1015.

The CVSS score of 4.7 classifies this as a medium‑severity vulnerability, and the EPSS score of less than 1% indicates a low probability of exploitation. The vulnerability is not listed in the CISA KEV catalog. Exploitation requires that an attacker be able to control the text of an item name that the FileManager will display in its drag hint – typically through administrative or user‑upload capabilities – and that the victim performs a drag action while a session is active. Successful exploitation can lead to the injection of arbitrary JavaScript, compromising data confidentiality and integrity for the affected application’s users.