CVE-2026-106149: CWE-80 Improper neutralization of Script-Related HTML tags in a web page (basic XSS) in Progress Software Kendo UI for jQuery

In Progress® Kendo® UI for jQuery versions from 2011.2.804 up to but not including 2026.3.1015, the Menu component improperly neutralizes script-related HTML tags. Specifically, it constructs HTML attributes from bound dataSource fields by string concatenation without proper sanitization. This allows an attacker with low privileges who can control these fields to inject JavaScript event-handler attributes. These injected scripts execute when a user interacts with the Menu, leading to a cross-site scripting (XSS) vulnerability that compromises confidentiality and integrity of data accessible in the user's browser context.

An attacker with low privileges who can control dataSource fields bound to the Menu component can inject malicious JavaScript event-handler attributes. When a user interacts with the affected Menu, the injected scripts execute, potentially compromising the confidentiality and integrity of data accessible in the user's browser context. There is no indication of impact on availability. No known exploits in the wild have been reported.

A fix is available in Progress Kendo UI for jQuery version 2026.3.1015 and later. Users should upgrade to version 2026.3.1015 or newer to remediate this vulnerability. No vendor advisory content was provided, so patch status is based on the version information in the description.