Progress Kendo UI for jQuery: Spreadsheet cross-site scripting (CVE-2026-124696)
Progress Kendo UI for jQuery contains a cross-site scripting vulnerability in the Spreadsheet component allowing for arbitrary JavaScript execution.
CVE search metadata
CVE search record: CVE-2026-124696. Severity: high. CVSS: 7.1. KEV: no. Product: Kendo UI for jQuery (< 2026.4.1111). Brief: Progress Kendo UI for jQuery: Spreadsheet cross-site scripting (CVE-2026-124696). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kendo-ui-xss-cve-2026-124696/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery (< 2026.4.1111)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:46 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery contains a cross-site scripting (XSS) vulnerability in the Spreadsheet component. The vulnerability exists because sheet names are inserted into the data-sheet-name attribute of the SheetsBar menu button without proper encoding. An attacker who can influence a sheet name can inject an event-handler attribute, leading to arbitrary JavaScript execution in the victim browser context upon hovering over the affected UI element.
Impact
Successful exploitation allows for the execution of arbitrary JavaScript within the user's browser, potentially compromising the confidentiality and integrity of data accessible to the user session.