CVE-2026-106148: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Progress Software Kendo UI for jQuery

Progress Software Kendo UI for jQuery prior to version 2026.3.1015 contains an improper neutralization of script-related HTML tags (CWE-80) vulnerability in the TabStrip, Menu, and PanelBar components. These components insert data source imageUrl values into single-quoted image src attributes without proper escaping, enabling an attacker with the ability to modify an image URL to inject additional HTML attributes, including event handlers. This can lead to JavaScript execution in the context of the user's browser when the affected component renders the image, potentially compromising confidentiality and integrity of accessible data. The earliest affected version is not confirmed, but versions from 2011.2.804 up to 2026.3.1015 are affected. The vulnerability has a CVSS 3.1 base score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N).

Successful exploitation allows an attacker to execute arbitrary JavaScript in the user's browser via injected HTML attributes in image src elements. This can compromise the confidentiality and integrity of data accessible to the affected application. The vulnerability requires the attacker to have the ability to modify image URLs and user interaction (UI:R). There is no known active exploitation in the wild.

This vulnerability is fixed in Progress Kendo UI for jQuery version 2026.3.1015. Users should upgrade to this version or later to remediate the issue. No other vendor advisories or temporary mitigations are provided. Patch status is confirmed by the vendor advisory.