CVE-2026-106161
Awaiting Analysis Awaiting Analysis - Queue

Badge XSS in Progress Kendo UI for jQuery

Publication date: 2026-10-15

Last updated on: 2026-10-15

Assigner: Progress Software Corporation

Description
In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing event handlers that execute JavaScript in a user's browser when the Badge renders the value. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-15
Last Modified
2026-10-15
Generated
2026-10-15
AI Q&A
2026-10-15
EPSS Evaluated
N/A
NVD
CVE-2026-106161
EUVD
EUVD-2026-102085

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
Progress Software Kendo UI for jQuery 2020.1.114

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-80 The product receives input from an upstream component, but it does not neutralize or incorrectly neutralizes special characters such as "<", ">", and "&" that could be interpreted as web-scripting elements when they are sent to a downstream component that processes web pages.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is a cross-site scripting (XSS) vulnerability in Progress Kendo UI for jQuery. The Badge text method renders string values as raw HTML without encoding. Attackers can inject HTML with event handlers that execute JavaScript when the Badge renders the value.

Detection Guidance

To detect this vulnerability, inspect applications using Kendo UI for jQuery versions prior to 2026.3.1015 for Badge components with dynamic text binding. Check if user-supplied data is rendered as raw HTML without encoding. Review network requests and DOM elements for event handlers like onmouseover or onclick in badge text.

Impact Analysis

An attacker could steal sensitive data, modify displayed content, or perform actions on behalf of users. This compromises the confidentiality and integrity of data accessible to the affected application.

Compliance Impact

This vulnerability could lead to unauthorized data access or modification, violating GDPR's integrity and confidentiality requirements and HIPAA's security rules for protected health information.

Mitigation Strategies

Immediately upgrade Kendo UI for jQuery to version 2026.3.1015 or later. If upgrading is not possible, disable or remove Badge components using dynamic text binding. Implement input validation to sanitize user-supplied data before rendering.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-106161. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart