CVE-2026-106151: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Progress Software Kendo UI for jQuery
Description
In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user's browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
CVSS v3.1
Score 5.4medium
Affected software
Progress Software
Kendo UI for jQuery
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Progress Software Kendo UI for jQuery versions >=2012.2.710 and <2026.3.1015 contain a CWE-80 improper neutralization of script-related HTML tags vulnerability. The Validator component decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. If an attacker can modify a validation message, they can inject active markup including event handlers, leading to cross-site scripting (XSS) when validation is triggered. This allows execution of arbitrary JavaScript in the context of the affected application, potentially compromising confidentiality and integrity of accessible data. The issue is resolved in version 2026.3.1015.
Potential Impact
Successful exploitation allows an attacker to execute arbitrary JavaScript in the victim's browser when validation is triggered, potentially compromising the confidentiality and integrity of data accessible to the affected application. The vulnerability does not impact availability. There are no known exploits in the wild at this time.
Mitigation Recommendations
A fix is available in Progress Software Kendo UI for jQuery version 2026.3.1015. Users should upgrade to this version or later to remediate the vulnerability. No other mitigation or workaround is specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ProgressSoftware
- Date Reserved
- 2026-10-06T15:51:11.738Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad0e4712cdf04f6563ba952
Added to database: 10/15/2026, 14:34:25 UTC
Last enriched: 10/15/2026, 14:48:39 UTC
Last updated: 10/15/2026, 19:00:26 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.