Progress Kendo UI for jQuery: Cross-Site Scripting (CVE-2026-124695)
Progress Kendo UI for jQuery contains a cross-site scripting vulnerability where the items[].hint configuration option improperly renders user-supplied input as HTML, allowing for the execution of arbitrary JavaScript in a victim's browser.
CVE search metadata
CVE search record: CVE-2026-124695. Severity: high. CVSS: 7.1. KEV: no. Product: Kendo UI for jQuery (< 2026.4.1111). Brief: Progress Kendo UI for jQuery: Cross-Site Scripting (CVE-2026-124695). Brief link: https://feed.craftedsignal.io/briefs/2026-11-progress-kendo-ui-xss-cve-2026-124695/
Triage facts
Revision 1- Applicability
- Kendo UI for jQuery (< 2026.4.1111)
- Evidence
- Unknown
- Severity
- High
- Sources
- 1 public source
- Freshness
- Revision 1Nov 12, 18:46 UTC
- Vulnerabilities
- 1 CVE
- Source quality
- A2Roughly even chance
Progress Kendo UI for jQuery contains a cross-site scripting (XSS) vulnerability (CVE-2026-124695) originating from the items[].hint configuration option. Although documented to accept only strings, the component renders the hint input as HTML. An attacker capable of influencing a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form.
Impact
Successful exploitation allows for the execution of arbitrary JavaScript within the victim's browser session, which may compromise the confidentiality and integrity of data available in the user's browser context.