Threats tagged 'ghsa-rh5h-75wf-2hwp'

Kendo UI for jQuery versions from 2026.3.1014 up to, but not including, 2026.4.1110 contain a vulnerability in the ActionSheet component where title, subtitle, and header button label values are not properly encoded before rendering. This allows an attacker who can control these values to inject malicious markup that executes JavaScript when a user opens the ActionSheet, potentially compromising data confidentiality and integrity in the user's browser context.