CVE-2026-106160: CWE-1321 Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') in Progress Software Kendo UI for jQuery

In Progress Kendo UI for jQuery prior to version 2026.3.1015, the Model.accept function does not properly guard against unsafe object paths when processing server-response keys, allowing prototype pollution via keys like __proto__, constructor, or prototype. This flaw enables attackers who can supply data accepted by the affected model to modify object prototype attributes, which may influence application behavior and compromise data confidentiality and integrity. The earliest affected version is not confirmed, but affected versions include >=2023.1.117 and <2026.3.1015. The vulnerability is addressed in version 2026.3.1015.

An attacker able to supply data to the affected model can modify object prototype attributes, potentially altering application behavior. This may lead to confidentiality and integrity compromises of application data depending on how the application uses the modified objects, including scenarios involving server-side JavaScript. There are no known exploits in the wild at this time.

This vulnerability is fixed in Progress Kendo UI for jQuery version 2026.3.1015. Users should upgrade to this version or later to remediate the issue. No additional mitigation steps are indicated by the vendor advisory.