CVE-2026-106157

In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected item is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-panelbar-url-xss-cve-2026-106157	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*

History

20 Oct 2026, 19:21

Type	Values Removed	Values Added
CPE		cpe:2.3:a:progress:kendo_ui::::::::
References	~~() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-panelbar-url-xss-cve-2026-106157 -~~	() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-panelbar-url-xss-cve-2026-106157 - Vendor Advisory
First Time		Progress Progress kendo Ui

15 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 14:17

Updated : 2026-10-20 19:21

NVD link : CVE-2026-106157

Mitre link : CVE-2026-106157

CVE.ORG link : CVE-2026-106157

JSON object : View

Products Affected

progress

kendo_ui

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-106157", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106157", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T18:29:25.727020Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "Kendo UI for jQuery", "versions": [{"status": "affected", "version": "2019.2.514", "lessThan": "2026.3.1015", "versionType": "custom"}], "defaultStatus": "unaffected"}]}], "published": "2026-10-15T14:17:14.367", "references": [{"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-panelbar-url-xss-cve-2026-106157", "tags": ["Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Kendo\u00ae UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected item is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015."}], "lastModified": "2026-10-20T19:21:25.813", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8771688A-4162-4EDD-BA98-D826E3EEB81E", "versionEndExcluding": "2026.3.1015", "versionStartIncluding": "2019.2.514"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}