CVE-2026-106134
Received Received - Intake

Cross-Site Scripting in Progress KendoReact Menu Component

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: Progress Software Corporation

Description
Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-106134
EUVD
EUVD-2026-118362

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software KendoReact From 1.3.0 (inc) to 16.2.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a Cross-Site Scripting (XSS) vulnerability in Progress Software KendoReact's Menu component. It affects versions 1.3.0 through 16.1.0. An attacker with low privileges can inject malicious JavaScript by manipulating Menu item data. When a user clicks the affected Menu item, the script executes in the application's origin.

Detection Guidance

This vulnerability can be detected by inspecting the Menu component in KendoReact applications for unsafe URLs in Menu items. Check if user-controlled data is rendered without proper sanitization. Review application logs for suspicious JavaScript execution patterns.

Impact Analysis

An attacker could steal user sessions, deface the application, or perform actions on behalf of users. Users clicking malicious Menu items may unknowingly execute harmful scripts, leading to data theft or unauthorized actions.

Compliance Impact

This XSS vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements. For HIPAA, it may expose protected health information, risking compliance with security rules.

Mitigation Strategies

Update KendoReact to a version beyond 16.1.0. Sanitize all Menu item URLs and data inputs. Implement Content Security Policy (CSP) headers to restrict inline script execution. Validate and encode user-provided data before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106134. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...