Threats affecting pkg:npm/@progress/kendo-ui

Progress Software Kendo UI for jQuery versions from 2026.3.1015 up to but not including 2026.4.1110 contain a cross-site scripting (XSS) vulnerability in the PropertyGrid component. This occurs because bound property values and items[].description are not properly encoded by default, allowing an attacker who can control these values to execute arbitrary JavaScript in the context of a user's browser. Exploitation could lead to compromise of data confidentiality and integrity within the user's browser session. The vulnerability is fixed in version 2026.4.1110.

A Cross-site Scripting (XSS) vulnerability exists in Progress Software Kendo UI for jQuery versions from 2026.3.1015 up to but not including 2026.4.1110. The issue occurs because PivotGrid and PivotConfigurator axis field names are passed to a chip template without proper encoding, allowing an attacker who can control an axis field name to execute arbitrary JavaScript in the context of a user's browser. This can lead to compromise of confidentiality and integrity of data accessible in the user's browser. The vulnerability is fixed in version 2026.4.1110.

CVE-2026-124692 is a cross-site scripting (XSS) vulnerability in Progress Software Kendo UI for jQuery versions from 2026.3.1015 up to, but not including, 2026.4.1110. The issue occurs because the Grid and TreeList column-reorder drag clue reparses header text as HTML, allowing an attacker who can influence column field or title values to execute arbitrary JavaScript when a user drags a column header with column reordering enabled. This can compromise the confidentiality and integrity of data in the user's browser context. The vulnerability is fixed in version 2026.4.1110.

CVE-2026-124690 is a cross-site scripting (XSS) vulnerability in Progress Software's Kendo UI for jQuery. The vulnerability arises because the sanitizeSvgContent() function parses custom icon markup into a live DOM before filtering, allowing an attacker who can control the icon content to execute JavaScript during icon creation. This issue affects versions from 2026.3.1015 up to but not including 2026.4.1110 and is fixed in version 2026.4.1110.

A Cross-site Scripting (XSS) vulnerability exists in Progress Software Kendo UI for jQuery versions from 2026.3.1014 up to, but not including, 2026.4.1110. The vulnerability arises because the ActionSheet component does not encode title, subtitle, and header button label values before rendering, allowing an attacker who can control these values to inject malicious JavaScript. Successful exploitation could compromise the confidentiality and integrity of data in the user's browser context. The issue is fixed in version 2026.4.1110.

CVE-2026-124688 is a cross-site scripting (XSS) vulnerability in Progress Software's Kendo UI for jQuery versions from 2012.1.322 up to but not including 2026.4.1111. The flaw exists in the TabStrip, PanelBar, and Menu widgets when mapping a dataSource field to the spriteCssClass property. An attacker who controls this data can inject malicious markup and event-handler attributes, leading to JavaScript execution in the context of the application's origin. This can allow attackers to access data and perform actions within the victim's authenticated session.

CVE-2026-124686 is an eval injection vulnerability in Progress Software's Kendo UI for jQuery. Versions from 2022.3.1109 up to but not including 2026.4.1111 are affected. The vulnerability arises because kendo.init() compiles data-* attribute values using new Function when invalid JSON is supplied, allowing low-privilege attackers to inject JavaScript that executes during widget initialization. Exploitation can compromise confidentiality and integrity of data in the user's browser context. The issue is fixed in version 2026.4.1111.