CVE-2026-106144
Received Received - Intake

Prototype Pollution in Progress Kendo UI for Angular

Publication date: 2026-11-06

Last updated on: 2026-11-06

Assigner: Progress Software Corporation

Description
Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-06
Last Modified
2026-11-06
Generated
2026-11-06
AI Q&A
2026-11-06
EPSS Evaluated
N/A
NVD
CVE-2026-106144
EUVD
EUVD-2026-118368

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress Software Kendo UI for Angular From 20.0.0 (inc) to 25.1.0 (exc)
Progress Software Kendo UI for Angular From 0 (inc) to 25.1.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Prototype Pollution issue in the Scheduler component of Progress Software Kendo UI for Angular versions before 25.1.0. It allows a high-privileged attacker who controls a field path processed by the Scheduler to modify the prototype of built-in objects, which can lead to limited impacts on confidentiality, integrity, and availability.

Impact Analysis

The impact is limited but includes potential risks to confidentiality, integrity, and availability of the application. An attacker could exploit this to manipulate object prototypes, which might lead to unexpected behavior or data corruption in the affected Kendo UI for Angular application.

Mitigation Strategies

Upgrade to Progress Software Kendo UI for Angular version 25.1.0 or later to address the Prototype Pollution vulnerability in the Scheduler component.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106144. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...