CVE-2026-106147: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Progress Software Kendo UI for jQuery
Description
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
CVSS v3.1
Score 5.4medium
Affected software
Progress Software
Kendo UI for jQuery
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Progress Software Kendo UI for jQuery versions >=2020.1.114 and <2026.3.1015 have an improper neutralization of script-related HTML tags (CWE-80) in the ListBox default item template. The bound dataTextField value is rendered as raw HTML without encoding, enabling an attacker who can modify this data to inject malicious HTML and JavaScript. This results in a basic cross-site scripting (XSS) vulnerability that can lead to compromise of data confidentiality and integrity. The vulnerability is addressed in version 2026.3.1015.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected application, potentially compromising the confidentiality and integrity of data accessible to users of the application. There is no indication of impact on availability. No known exploits in the wild have been reported.
Mitigation Recommendations
A fixed version 2026.3.1015 is available that addresses this vulnerability. Users should upgrade to version 2026.3.1015 or later to remediate this issue. No other vendor advisories indicate alternative mitigations or that no action is required.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ProgressSoftware
- Date Reserved
- 2026-10-06T15:51:11.738Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad0d9df2cdf04f656389d47
Added to database: 10/15/2026, 13:49:19 UTC
Last enriched: 10/15/2026, 14:03:42 UTC
Last updated: 10/15/2026, 19:00:26 UTC
Views: 12
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.