Threats tagged 'ghsa-h3pm-2mg5-rjm6'

Kendo UI for jQuery versions from 2026.3.1015 up to, but not including, 2026.4.1110 contain a vulnerability in the PivotGrid and PivotConfigurator components. Axis field names are passed to a chip template without proper encoding, allowing an attacker who can control these field names to execute JavaScript when a user views the rendered chip. This can lead to compromise of data confidentiality and integrity in the user's browser context.