CVE-2026-106148
Awaiting Analysis Awaiting Analysis - Queue

XSS in Progress Kendo UI for jQuery via Image URL

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected component renders the image. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106148
EUVD
EUVD-2026-102087

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2011.2.804

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Progress Kendo UI for jQuery versions prior to 2026.3.1015. The TabStrip, Menu, and PanelBar components improperly handle image URLs by inserting them into HTML image src attributes without proper escaping. This allows attackers to inject malicious HTML attributes, including JavaScript event handlers, which execute in a user's browser when the component renders the image.

Detection Guidance

Check if your Kendo UI for jQuery version is prior to 2026.3.1015. Inspect components like TabStrip, Menu, and PanelBar for imageUrl values rendered in single-quoted src attributes. Look for unusual HTML attributes or event handlers in rendered output.

Impact Analysis

An attacker could exploit this to steal sensitive data, such as session cookies or personal information, by executing malicious scripts in the context of the affected application. This could lead to unauthorized access, data theft, or defacement of the application.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR's data protection requirements or HIPAA's security rules for protected health information. Organizations using affected versions may face compliance violations, legal penalties, and reputational damage.

Mitigation Strategies

Upgrade Kendo UI for jQuery to version 2026.3.1015 or later. Review and sanitize all imageUrl inputs to prevent injection of malicious HTML attributes or JavaScript.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106148. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart