CVE-2026-106147
Awaiting Analysis Awaiting Analysis - Queue

XSS in Progress Kendo UI for jQuery

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106147
EUVD
EUVD-2026-102086

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2020.1.114

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a cross-site scripting (XSS) issue in Progress Kendo UI for jQuery. It affects versions from R1 2020 up to before 2026.3.1015. The ListBox component renders user-supplied data as raw HTML without proper encoding. Attackers can inject malicious HTML with event handlers that execute JavaScript in a victim's browser when the list item is displayed.

Detection Guidance

To detect this vulnerability, inspect your Kendo UI for jQuery ListBox components for versions prior to 2026.3.1015. Check if the ListBox uses a bound dataTextField that renders HTML without encoding. Review application code for ListBox configurations where user-controlled data might be injected.

Impact Analysis

An attacker could steal sensitive data like session cookies or personal information from the affected application. They might also perform actions on behalf of users, such as modifying data or redirecting to malicious sites. The impact depends on the application's data and user privileges.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles. For HIPAA, it may compromise protected health information security. Organizations using affected versions risk non-compliance with data protection requirements.

Mitigation Strategies

Upgrade to Kendo UI for jQuery version 2026.3.1015 or later. If upgrading is not immediately possible, review and sanitize all data bound to ListBox components to ensure no HTML or JavaScript is included. Apply input validation and output encoding to prevent XSS attacks.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106147. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart