CVE-2026-106157: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Progress Software Kendo UI for jQuery

In Progress Kendo UI for jQuery versions >=2019.2.514 and <2026.3.1015, the PanelBar component fails to properly encode URL values inserted into a single-quoted href attribute. This improper neutralization of script-related HTML tags (CWE-80) allows an attacker who controls an item URL to inject additional HTML attributes, including event handlers, resulting in JavaScript execution in the user's browser upon interaction with the affected item. This vulnerability can compromise confidentiality and integrity of data accessible to the application. The vulnerability is addressed in version 2026.3.1015.

Successful exploitation allows an attacker to execute arbitrary JavaScript in the context of the affected application, potentially compromising the confidentiality and integrity of data accessible to the application. The CVSS 3.1 score is 4.7 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and impact on confidentiality and integrity but not availability.

A fix is available in Progress Kendo UI for jQuery version 2026.3.1015. Users should upgrade to this version or later to remediate the vulnerability. No other vendor advisories indicate alternative mitigations or that no action is required.