Threats tagged 'ghsa-rjfx-524j-r2fc'

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111 contain a vulnerability in the kendo.init() function where data-* attribute values are compiled using new Function when invalid JSON is supplied. This allows an attacker with low privileges who can control these attributes to inject JavaScript that executes during widget initialization, potentially compromising data confidentiality and integrity in the user's browser. The issue was reported in version 2022.3.1109, but the exact first affected version is not established.