CVE-2026-106147

In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS v3 5.4 MEDIUM

5.4^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 2.3 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-listbox-bound-text-xss-cve-2026-106147	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*

History

20 Oct 2026, 19:21

Type	Values Removed	Values Added
First Time		Progress Progress kendo Ui
References	~~() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-listbox-bound-text-xss-cve-2026-106147 -~~	() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-listbox-bound-text-xss-cve-2026-106147 - Vendor Advisory
CPE		cpe:2.3:a:progress:kendo_ui::::::::

15 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 14:17

Updated : 2026-10-20 19:21

NVD link : CVE-2026-106147

Mitre link : CVE-2026-106147

CVE.ORG link : CVE-2026-106147

JSON object : View

Products Affected

progress

kendo_ui

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-106147", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106147", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T18:07:59.615649Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 5.4, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 2.3}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "Kendo UI for jQuery", "versions": [{"status": "affected", "version": "2020.1.114", "lessThan": "2026.3.1015", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-15T14:17:14.120", "references": [{"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-listbox-bound-text-xss-cve-2026-106147", "tags": ["Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Kendo\u00ae UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015."}], "lastModified": "2026-10-20T19:21:42.213", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58E040B7-132A-4989-93AC-F3AF61095F57", "versionEndExcluding": "2026.3.1015", "versionStartIncluding": "2020.1.114"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}