Threats tagged 'ghsa-46fp-mfqx-g54j'

Kendo UI for jQuery versions from 2026.3.1015 up to, but not including, 2026.4.1110 contain a vulnerability in the Grid and TreeList components where the column-reorder drag clue reparses header text as HTML. This allows an attacker who can control a column field or title to execute JavaScript when a user drags a column header with column reordering enabled, potentially compromising data confidentiality and integrity in the user's browser.