CVE-2026-106150: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Progress Software Kendo UI for jQuery

In Progress Kendo UI for jQuery prior to version 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 improperly handle iframe markup generation. Specifically, URL values are not sanitized and iframe titles are not encoded, enabling injection of HTML attributes including JavaScript event handlers via crafted apostrophes in URLs or titles. This leads to a cross-site scripting vulnerability (CWE-79) that can execute arbitrary JavaScript in the context of the user's browser when interacting with the affected components.

An attacker with low privileges who can control iframe URL or title values can inject malicious JavaScript that executes in the context of the user's browser. This can compromise the confidentiality and integrity of data accessible to the user. The vulnerability requires user interaction and does not affect availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, low privileges required, user interaction needed, and impact on confidentiality and integrity.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, avoid using affected versions or restrict user input that can influence iframe URLs or titles in the affected components. Monitor vendor communications for patches or updates addressing this vulnerability.