CVE-2026-124695
Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Kendo UI for jQuery Form

Publication date: 2026-11-12

Last updated on: 2026-11-12

Assigner: Progress Software Corporation

Description
In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-12
Last Modified
2026-11-12
Generated
2026-11-12
AI Q&A
2026-11-12
EPSS Evaluated
N/A
NVD
CVE-2026-124695
EUVD
EUVD-2026-124547

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery From 2020.2.513 (inc) to 2026.3.1015 (inc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Progress Kendo UI for jQuery Form. The items[].hint option is documented as a string but rendered as HTML. An attacker can inject malicious markup into a form's hint, which executes as JavaScript when a user views the form. This compromises data confidentiality and integrity in the user's browser.

Detection Guidance

To detect this vulnerability, inspect your Kendo UI for jQuery Form versions. Check if your version is between 2020.2.513 and 2026.3.1015. Review any forms using the items[].hint option for potential XSS vectors. Use browser developer tools to examine rendered hint content for unexpected HTML or JavaScript execution.

Impact Analysis

An attacker could steal sensitive data like session cookies or personal information, modify displayed content, or perform actions on your behalf within the application. This could lead to account takeover or unauthorized data access if you interact with a vulnerable form.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations and potential penalties.

Mitigation Strategies

Immediately upgrade to Kendo UI for jQuery version 2026.4.1111 or later. If upgrading is not possible, disable or sanitize the hint option for all form items. Implement input validation to prevent malicious markup in hint values. Monitor for unusual activity in user sessions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-124695. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...