Progress Kendo UI for jQuery: PropertyGrid Cross-Site Scripting (CVE-2026-124694)
Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 contain an XSS vulnerability in the PropertyGrid component due to insufficient encoding of bound property values.
CVE search metadata
CVE search record: CVE-2026-124694. Severity: high. CVSS: 7.1. KEV: no. Product: Kendo UI for jQuery (< 2026.4.1110). Brief: Progress Kendo UI for jQuery: PropertyGrid Cross-Site Scripting (CVE-2026-124694). Brief link: https://feed.craftedsignal.io/briefs/2026-11-kendo-xss-cve-2026-124694/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery (< 2026.4.1110)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 11, 18:01 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 contain a vulnerability in the PropertyGrid component. The component fails to properly encode bound property values and items[].description in its default configuration.
Impact
An attacker who can influence the affected values can cause JavaScript to execute when a user views the grid, which may compromise the confidentiality and integrity of data available in the user's browser context.
Recommendation
Upgrade to Kendo UI for jQuery version 2026.4.1110 or later.