Progress Kendo UI for jQuery Vulnerability (CVE-2026-124692)
Progress Kendo UI for jQuery contains a vulnerability in the Grid and TreeList components where column-reorder drag clues parse header text as HTML, potentially allowing JavaScript execution.
CVE search metadata
CVE search record: CVE-2026-124692. Severity: high. CVSS: 7.1. KEV: no. Product: Kendo UI for jQuery. Brief: Progress Kendo UI for jQuery Vulnerability (CVE-2026-124692). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124692/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 18:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 are affected by a vulnerability in the Grid and TreeList components. The issue occurs when the column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled.
Impact
Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The vulnerability has a CVSS v3.1 base score of 7.1.