CVE-2026-106158
Awaiting Analysis Awaiting Analysis - Queue

Scheduler View XSS in Progress Kendo UI for jQuery

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected event is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106158
EUVD
EUVD-2026-102082

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2014.3.1119

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Progress Kendo UI for jQuery. It affects the Scheduler component's Day, Timeline, Month, and Agenda views. The issue occurs when resource color values are inserted into event wrapper attributes without proper encoding. An attacker can inject malicious HTML attributes, including event handlers, to execute JavaScript in a user's browser when interacting with the affected event.

Detection Guidance

To detect this vulnerability, inspect Kendo UI for jQuery Scheduler implementations for improperly encoded resource color values in Day, Timeline, Month, and Agenda views. Check if user-controlled color inputs are reflected in HTML attributes without sanitization. Review event handlers and DOM structures for unexpected attributes or JavaScript execution.

Impact Analysis

This vulnerability can compromise the confidentiality and integrity of data accessible to the affected application. An attacker could steal sensitive information, perform actions on behalf of the user, or manipulate the application's behavior. Users interacting with compromised events may have their sessions hijacked or data exposed.

Compliance Impact

This vulnerability could lead to data breaches, which may violate GDPR and HIPAA compliance requirements. GDPR mandates protection of personal data, while HIPAA requires safeguarding protected health information. A successful exploit could result in unauthorized access to sensitive data, potentially leading to regulatory penalties and loss of trust.

Mitigation Strategies
  • Upgrade Kendo UI for jQuery to version 2026.3.1015 or later to address the vulnerability.
  • Review and sanitize any user-controlled resource color values in the Scheduler component to prevent HTML attribute injection.
  • Monitor for unusual activity in the application, particularly around event handlers and user interactions with the Scheduler views.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106158. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart