CVE-2026-106158: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Progress Software Kendo UI for jQuery

In Progress Kendo UI for jQuery versions >=2014.3.1119 and <2026.3.1015, the Scheduler Day, Timeline, Month, and Agenda views improperly encode resource color values when inserting them into quoted event wrapper attributes. This improper neutralization of script-related HTML tags (CWE-80) allows an attacker who can control a resource color to inject additional HTML attributes, including event handlers, resulting in cross-site scripting (XSS). Successful exploitation can execute arbitrary JavaScript in the context of the affected application, potentially compromising confidentiality and integrity of accessible data. The vulnerability is fixed in version 2026.3.1015.

Exploitation of this vulnerability allows an attacker to execute arbitrary JavaScript in the context of the affected application when a user interacts with the maliciously crafted event. This can lead to compromise of confidentiality and integrity of data accessible to the application. The CVSS score of 4.7 indicates a medium severity impact with network attack vector, high attack complexity, no privileges required, user interaction required, and scope changed.

This vulnerability is fixed in Progress Kendo UI for jQuery version 2026.3.1015. Users should upgrade to this version or later to remediate the issue. No additional mitigations are specified in the vendor advisory.