CVE-2026-106151
Awaiting Analysis Awaiting Analysis - Queue

In Progress Kendo UI for jQuery HTML Parsing Flaw

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user's browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106151
EUVD
EUVD-2026-102078

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2012.2.710

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability affects Progress Kendo UI for jQuery versions before 2026.3.1015. The Validator decodes validation messages from data-msg-* attributes and parses them as HTML. An attacker who modifies a validation message can inject active HTML markup, including event handlers, which executes JavaScript in a user's browser when validation is triggered.

Detection Guidance

Check if your Kendo UI for jQuery version is prior to 2026.3.1015. Inspect web pages using the Validator component for data-msg-* attributes that may contain HTML content. Use browser developer tools to review validation messages for unexpected script execution.

Impact Analysis

This vulnerability can compromise the confidentiality and integrity of data accessible to the affected application. Attackers can execute JavaScript in a user's browser, potentially stealing sensitive information or performing unauthorized actions on behalf of the user.

Mitigation Strategies

Upgrade to Kendo UI for jQuery version 2026.3.1015 or later. If immediate upgrade is not possible, review and sanitize all validation messages to prevent HTML injection. Monitor for unusual script execution in user browsers.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106151. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart