CVE-2026-106153: CWE-79 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Progress Software Kendo UI for jQuery

Progress Software Kendo UI for jQuery prior to version 2026.3.1015 contains an XSS vulnerability (CWE-79) in the Calendar and MultiViewCalendar month content templates. These templates improperly neutralize input by rendering data.url and data.title without adequate sanitization or encoding. An attacker with low privileges who can influence these values can inject JavaScript URLs or event-handler attributes. When users interact with the affected calendar UI, the injected script executes in their browser context, potentially compromising confidentiality and integrity of accessible data.

Successful exploitation allows an attacker with low privileges to execute arbitrary JavaScript in the context of users interacting with the affected calendar components. This can lead to compromise of confidentiality and integrity of data accessible to the user. The vulnerability requires user interaction and low privilege attacker control over certain input values. There is no indication of impact to availability.

A fixed version 2026.3.1015 or later is available that addresses this vulnerability. Users should upgrade to version 2026.3.1015 or later to remediate this issue. No additional vendor advisory or patch links were provided, so check official Progress Software resources for the update. Until patched, avoid using affected calendar templates with untrusted input or apply custom sanitization.