Kendo UI for jQuery versions prior to 2026.4.1111 have a vulnerability in the TabStrip, PanelBar, and Menu widgets where an attacker controlling dataSource fields mapped to spriteCssClass can inject markup with event-handler attributes. This leads to JavaScript execution in the application's origin when a victim loads the affected widget, potentially exposing data and actions available in the victim's authenticated session.