CVE-2026-106128
Received Received - Intake

Prototype Pollution in Progress Kendo UI for Vue

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: Progress Software Corporation

Description
Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-106128
EUVD
EUVD-2026-118372

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for Vue From 0.4.0 (inc) to 10.0.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Prototype Pollution vulnerability in the @progress/kendo-vue-common library, part of Progress Software Kendo UI for Vue. It affects versions 0.4.0 through 9.2.0. An attacker with high privileges who can control a field path processed by components like the Scheduler can modify the prototype of built-in JavaScript objects.

Impact Analysis

The impact is limited but includes potential risks to confidentiality, integrity, and availability of the application. Attackers could manipulate object prototypes to alter application behavior, leading to unexpected outcomes or disruptions.

Mitigation Strategies

Upgrade Progress Software Kendo UI for Vue to a version beyond 9.2.0 to address the Prototype Pollution vulnerability in @progress/kendo-vue-common.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106128. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...