Progress Kendo UI for jQuery: Markup injection in TabStrip, PanelBar, and Menu widgets (CVE-2026-124688)
Progress Kendo UI for jQuery versions prior to 2026.4.1111 are vulnerable to markup injection in the TabStrip, PanelBar, and Menu widgets when a dataSource field is mapped to spriteCssClass, potentially leading to unauthorized JavaScript execution.
CVE search metadata
CVE search record: CVE-2026-124688. KEV: no. Product: Kendo UI for jQuery. Brief: Progress Kendo UI for jQuery: Markup injection in TabStrip, PanelBar, and Menu widgets (CVE-2026-124688). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124688/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 18:00 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery versions prior to 2026.4.1111 contain a vulnerability in the TabStrip, PanelBar, and Menu widgets. The issue exists because these widgets support mapping a dataSource field to the spriteCssClass attribute. If an attacker controls the mapped data, they can break out of the attribute and inject markup, including event-handler attributes.
Impact
The injected JavaScript executes in the application's origin when a victim loads a page rendering the affected widget, allowing access to data and actions available in the victim's authenticated session.
Recommendation
Upgrade to Progress Kendo UI for jQuery version 2026.4.1111 or later.