Progress Kendo UI for jQuery: Markup injection in DropDownButton and SplitButton (CVE-2026-124687)
Progress Kendo UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 contain a markup injection vulnerability in the DropDownButton and SplitButton components via the id and target attributes.
CVE search metadata
CVE search record: CVE-2026-124687. KEV: no. Product: Kendo UI for jQuery. Brief: Progress Kendo UI for jQuery: Markup injection in DropDownButton and SplitButton (CVE-2026-124687). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-injection-cve-2026-124687/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 18:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery contains a markup injection vulnerability in the DropDownButton and SplitButton components, identified as CVE-2026-124687. The vulnerability affects versions from 2022.2.621 prior to 2026.4.1111. An attacker who can influence the 'id' and 'target' attributes of these components can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.
Impact
An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. This vulnerability has a CVSS v3.1 base score of 7.1.
Recommendation
Upgrade Progress Kendo UI for jQuery to version 2026.4.1111.