CVE-2026-106159
Awaiting Analysis Awaiting Analysis - Queue

DOM XSS in Progress Kendo UI for jQuery via Malicious Button URLs

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing whitespace and additional attributes, including an event handler, and execute JavaScript in a user's browser when the affected button is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106159
EUVD
EUVD-2026-102083

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2022.3.1109

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Progress Kendo UI for jQuery. It affects ToolBar ButtonGroup button URLs in versions from 2022.3.1109 up to but not including 2026.3.1015. The issue occurs when button URLs are concatenated into an unquoted href attribute after sanitization. An attacker can inject malicious JavaScript via a crafted HTTPS URL containing whitespace and event handlers.

Detection Guidance

Check if your Kendo UI for jQuery version is between 2022.3.1109 and prior to 2026.3.1015. Inspect ToolBar ButtonGroup button URLs for improper sanitization or unquoted href attributes. Look for whitespace or event handlers in URLs.

Impact Analysis

An attacker could execute arbitrary JavaScript in a user's browser when they interact with the affected button. This could lead to theft of session cookies, sensitive data exposure, or unauthorized actions on behalf of the user. The impact includes compromised confidentiality and integrity of data accessible to the application.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations using affected versions may face compliance violations, potential fines, and reputational damage due to data breaches.

Mitigation Strategies

Upgrade Kendo UI for jQuery to version 2026.3.1015 or later. Review and sanitize all ToolBar ButtonGroup button URLs to ensure proper encoding and validation.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106159. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart