CVE-2026-106157
Awaiting Analysis Awaiting Analysis - Queue

Cross-Site Scripting in Progress Kendo UI for jQuery

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected item is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106157
EUVD
EUVD-2026-102081

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2019.2.514

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Progress Kendo UI for jQuery. The PanelBar component does not properly encode URLs in item data sources before inserting them into an href attribute. An attacker can inject malicious HTML or JavaScript via a controlled URL, which executes when a user interacts with the affected item.

Detection Guidance

To detect this vulnerability, inspect your Kendo UI for jQuery PanelBar component versions. Check if the version is between 2019.2.514 and prior to 2026.3.1015. Review any custom item URLs in the PanelBar for improper encoding or JavaScript event handlers in href attributes.

Impact Analysis

An attacker could steal user session cookies, redirect users to malicious sites, or perform actions on behalf of the user. This compromises data confidentiality and integrity for users of the affected application.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR (data protection) and HIPAA (health data privacy) requirements. Organizations using the vulnerable version may face compliance violations and potential legal consequences.

Mitigation Strategies

Upgrade to Kendo UI for jQuery version 2026.3.1015 or later immediately. If upgrading is not possible, remove or sanitize user-controlled URLs in PanelBar items and implement strict input validation for href attributes.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106157. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart