CVE-2026-106127
Received Received - Intake

Prototype Pollution in Progress KendoReact Setter Utility

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: Progress Software Corporation

Description
Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-106127
EUVD
EUVD-2026-118370

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software KendoReact From 3.5.0 (inc) to 16.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Prototype Pollution issue in the setter utility (@progress/kendo-react-common) of Progress Software KendoReact versions 3.5.0 through 16.0.0. It allows a high-privileged attacker to manipulate the prototype of built-in objects by controlling a field path passed to the utility or through components like Form, Scheduler, and Gantt.

Impact Analysis

The impact is limited but includes potential risks to confidentiality, integrity, and availability of the affected system. An attacker could modify object prototypes, leading to unexpected behavior or disruptions in functionality.

Mitigation Strategies

Update Progress Software KendoReact to a version outside the affected range (3.5.0 through 16.0.0). Avoid passing user-controlled field paths to the setter utility or components like Form, Scheduler, and Gantt.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106127. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...