CVE-2026-106161: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Progress Software Kendo UI for jQuery

Progress Software Kendo UI for jQuery versions from 2020.1.114 up to but not including 2026.3.1015 contain a vulnerability in the Badge text method where string values are rendered as raw HTML without proper encoding. This improper neutralization of script-related HTML tags (CWE-80) allows an attacker who can control data bound to a Badge to inject HTML with event handlers that execute JavaScript in the context of the user's browser. This vulnerability can compromise confidentiality and integrity of data accessible to the affected application. The vulnerability is addressed in version 2026.3.1015.

Successful exploitation allows execution of arbitrary JavaScript in the user's browser via injected HTML in Badge text, potentially compromising the confidentiality and integrity of data accessible to the affected application. There is no indication of impact on availability. The CVSS 3.1 base score is 5.4 (medium severity), reflecting network attack vector, low attack complexity, required privileges, user interaction, and partial confidentiality and integrity impact.

A fix is available in Progress Software Kendo UI for jQuery version 2026.3.1015. Users should upgrade to this version or later to remediate the vulnerability. No additional vendor advisory content is provided, so check the vendor's official resources for further guidance.