Progress Kendo UI for jQuery: Cross-Site Scripting (CVE-2026-124693)
Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 are vulnerable to Cross-Site Scripting due to improper encoding of axis field names in PivotGrid and PivotConfigurator components.
CVE search metadata
CVE search record: CVE-2026-124693. Severity: high. CVSS: 7.1. KEV: no. Product: Kendo UI for jQuery. Brief: Progress Kendo UI for jQuery: Cross-Site Scripting (CVE-2026-124693). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124693/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 20:06 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 contain a vulnerability where PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip, as the field name can be interpreted as HTML in both attribute and element contexts.
Impact
Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The CVSS v3.1 Base Score is 7.1.