CVE-2026-106160
Awaiting Analysis Awaiting Analysis - Queue

Prototype Pollution in Progress Kendo UI for jQuery

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106160
EUVD
EUVD-2026-102084

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2023.1.117

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-1321 The product receives input from an upstream component that specifies attributes that are to be initialized or updated in an object, but it does not properly control modifications of attributes of the object prototype.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a prototype pollution vulnerability in Progress Kendo UI for jQuery before version 2026.3.1015. The Model.accept function passes server-response keys to kendo.setter without checking for unsafe object paths like __proto__, constructor, or prototype. An attacker can exploit this to modify object prototype attributes and influence application behavior.

Detection Guidance

To detect this vulnerability, inspect your Kendo UI for jQuery version. If it is prior to 2026.3.1015, the system is vulnerable. Check application code for Model.accept usage and validate if server responses are processed safely.

Impact Analysis

An attacker who can supply data accepted by an affected model may compromise application data confidentiality and integrity. The impact depends on how the application uses modified objects, including potential server-side JavaScript scenarios.

Compliance Impact

This vulnerability could potentially compromise the confidentiality and integrity of application data, which may impact compliance with standards like GDPR and HIPAA that require protection of personal and health data. The prototype pollution could allow attackers to influence application behavior, leading to unauthorized data access or modification.

Mitigation Strategies

Upgrade Kendo UI for jQuery to version 2026.3.1015 or later immediately. Review and sanitize server responses accepted by Model.accept to prevent prototype pollution. Apply input validation and output encoding in affected applications.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106160. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart