Kendo UI for JQuery - CraftedSignal Threat Feed

Progress Kendo UI for jQuery Vulnerability (CVE-2026-124692)

hello@craftedsignal.io — Wed, 11 Nov 2026 18:01:16 +0000

Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110 are affected by a vulnerability in the Grid and TreeList components. The issue occurs when the column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled.

Impact

Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The vulnerability has a CVSS v3.1 base score of 7.1.

Progress Kendo UI for jQuery Vulnerability (CVE-2026-124689)

hello@craftedsignal.io — Wed, 11 Nov 2026 18:00:52 +0000

Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110 contain a vulnerability in the ActionSheet component. The component does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet.

Impact

Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.

Recommendation

The vulnerability is addressed in version 2026.4.1110.

Progress Kendo UI for jQuery: Markup injection in TabStrip, PanelBar, and Menu widgets (CVE-2026-124688)

hello@craftedsignal.io — Wed, 11 Nov 2026 18:00:43 +0000

Progress Kendo UI for jQuery versions prior to 2026.4.1111 contain a vulnerability in the TabStrip, PanelBar, and Menu widgets. The issue exists because these widgets support mapping a dataSource field to the spriteCssClass attribute. If an attacker controls the mapped data, they can break out of the attribute and inject markup, including event-handler attributes.

Impact

The injected JavaScript executes in the application's origin when a victim loads a page rendering the affected widget, allowing access to data and actions available in the victim's authenticated session.

Recommendation

Upgrade to Progress Kendo UI for jQuery version 2026.4.1111 or later.

Progress Kendo UI for jQuery: Markup injection in DropDownButton and SplitButton (CVE-2026-124687)

hello@craftedsignal.io — Wed, 11 Nov 2026 18:00:33 +0000

Progress Kendo UI for jQuery contains a markup injection vulnerability in the DropDownButton and SplitButton components, identified as CVE-2026-124687. The vulnerability affects versions from 2022.2.621 prior to 2026.4.1111. An attacker who can influence the 'id' and 'target' attributes of these components can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.

Impact

An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. This vulnerability has a CVSS v3.1 base score of 7.1.

Recommendation

Upgrade Progress Kendo UI for jQuery to version 2026.4.1111.