CVE-2026-106150
Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Progress Kendo UI for jQuery

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user's browser context, compromising the confidentiality and integrity of accessible data.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106150
EUVD
EUVD-2026-102077

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2013.1.319
Progress Software Kendo UI for jQuery 2011.2.804

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Progress Kendo UI for jQuery versions prior to 2026.3.1015. The Splitter and Window components (since 2011.2.804) and Tooltip component (since 2013.1.319) fail to properly sanitize iframe URLs or encode titles. Attackers can inject HTML attributes, including JavaScript event handlers, via crafted URLs or titles. When users interact with these components, the injected scripts execute in their browser context.

Detection Guidance

Check if your Kendo UI for jQuery version is prior to 2026.3.1015. Inspect components like Splitter, Window, and Tooltip for iframe URLs or titles containing unsanitized user input or JavaScript event handlers.

Impact Analysis

An attacker could steal sensitive data like session cookies or personal information, perform actions on your behalf, or redirect you to malicious sites. The impact depends on user privileges and data access. Since exploitation requires low-privilege interaction, it primarily risks user data confidentiality and integrity.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality principles or HIPAA's safeguards for protected health information. Organizations using affected versions may face compliance violations if user data is compromised.

Mitigation Strategies

Upgrade to Kendo UI for jQuery version 2026.3.1015 or later. Review and sanitize all user-controlled inputs used in iframe URLs and titles for the affected components.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106150. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart