In Progress Kendo UI for jQuery contains a vulnerability in the sanitizeSvgContent() function where custom icon markup is parsed into a live DOM before filtering. This allows an attacker who can control the custom icon content to execute JavaScript during icon creation before unsafe elements are removed. The issue was reported in version 2026.3.1015 and fixed in version 2026.4.1110.