CVE-2026-106159: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Progress Software Kendo UI for jQuery

In Progress Kendo UI for jQuery versions >=2022.3.1109 and <2026.3.1015, the ToolBar ButtonGroup component improperly handles button URLs by concatenating them into an unquoted href attribute even after URL sanitization. This allows an attacker who controls a button URL to supply an HTTPS URL containing whitespace and extra attributes, including event handlers, resulting in cross-site scripting (CWE-80). Successful exploitation enables JavaScript execution in the context of the affected application, potentially compromising confidentiality and integrity of accessible data. The issue is resolved in version 2026.3.1015.

Exploitation of this vulnerability can lead to execution of arbitrary JavaScript in the user's browser when interacting with the affected button, potentially compromising the confidentiality and integrity of data accessible to the application. The CVSS 3.1 base score is 4.7 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and partial confidentiality and integrity impact.

Upgrade to Progress Kendo UI for jQuery version 2026.3.1015 or later, where this vulnerability is fixed. No other mitigation or workaround is indicated by the vendor advisory.