Progress Kendo UI for jQuery: sanitizeSvgContent() cross-site scripting (CVE-2026-124690)
Progress Kendo UI for jQuery contains a vulnerability in the sanitizeSvgContent() function where parsing custom icon markup into a live DOM before filtering enables arbitrary JavaScript execution.
CVE search metadata
CVE search record: CVE-2026-124690. Severity: high. CVSS: 7.1. KEV: no. Product: Kendo UI for jQuery (< 2026.4.1110). Brief: Progress Kendo UI for jQuery: sanitizeSvgContent() cross-site scripting (CVE-2026-124690). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124690/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery (< 2026.4.1110)
- Evidence
- Not observed
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 18:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery contains a vulnerability in the sanitizeSvgContent() function. The component parses custom icon markup into a live DOM before applying sanitization filters. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed.
Impact
Successful exploitation allows for the execution of arbitrary JavaScript.
Recommendation
Upgrade to the fixed version 2026.4.1110.