CVE-2026-106162: CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) in Progress Software Kendo UI for jQuery
Description
In Progress® Kendo® UI for jQuery versions starting with 2023.3.1010 and prior to 2026.3.1015, the FileManager component renders remotely supplied item names as HTML in its default drag hint even though the corresponding list items are encoded. An attacker who can control an item name can inject HTML containing event handlers that execute JavaScript in a user's browser when the user drags the affected item. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
CVSS v3.1
Score 4.7medium
Affected software
Progress Software
Kendo UI for jQuery
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2026-106162 is a CWE-80 improper neutralization of script-related HTML tags vulnerability in the FileManager component of Progress Kendo UI for jQuery. Versions >=2023.3.1010 and <2026.3.1015 render remotely supplied item names as HTML in drag hints without proper encoding, enabling an attacker who controls an item name to inject HTML with event handlers that execute JavaScript in the victim's browser when dragging the item. This vulnerability allows compromise of confidentiality and integrity of data accessible to the application. The vulnerability is resolved in version 2026.3.1015.
Potential Impact
Successful exploitation allows execution of arbitrary JavaScript in the context of the affected application, potentially compromising the confidentiality and integrity of data accessible to the user. The CVSS v3.1 score is 4.7 (medium severity), reflecting network attack vector, high attack complexity, no privileges required, user interaction required, and partial impact on confidentiality and integrity.
Mitigation Recommendations
This vulnerability is fixed in Progress Kendo UI for jQuery version 2026.3.1015. Users should upgrade to this version or later to remediate the issue. No other mitigation or temporary workaround is indicated.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- ProgressSoftware
- Date Reserved
- 2026-10-06T15:51:16.740Z
- Cvss Version
- 3.1
- State
- PUBLISHED
Threat ID: 6ad0d6522cdf04f65637ed8e
Added to database: 10/15/2026, 13:34:10 UTC
Last enriched: 10/15/2026, 13:48:25 UTC
Last updated: 10/15/2026, 19:04:20 UTC
Views: 14
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.