CVE-2026-106158

In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected event is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

CVSS v3 4.7 MEDIUM

4.7^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 1.6 / Impact : 2.7

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope CHANGED

References

Link	Resource
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-scheduler-resource-color-xss-cve-2026-106158	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*

History

20 Oct 2026, 19:21

Type	Values Removed	Values Added
CPE		cpe:2.3:a:progress:kendo_ui::::::::
First Time		Progress Progress kendo Ui
References	~~() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-scheduler-resource-color-xss-cve-2026-106158 -~~	() https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-scheduler-resource-color-xss-cve-2026-106158 - Vendor Advisory

15 Oct 2026, 14:17

Type	Values Removed	Values Added
New CVE

Information

Published : 2026-10-15 14:17

Updated : 2026-10-20 19:21

NVD link : CVE-2026-106158

Mitre link : CVE-2026-106158

CVE.ORG link : CVE-2026-106158

JSON object : View

Products Affected

progress

kendo_ui

CWE

CWE-80

Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

{"id": "CVE-2026-106158", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-106158", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T18:29:04.906494Z"}}], "cvssMetricV31": [{"type": "Secondary", "source": "security@progress.com", "cvssData": {"scope": "CHANGED", "version": "3.1", "baseScore": 4.7, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.7, "exploitabilityScore": 1.6}]}, "affected": [{"source": "security@progress.com", "affectedData": [{"vendor": "Progress Software", "product": "Kendo UI for jQuery", "versions": [{"status": "affected", "version": "2014.3.1119", "lessThan": "2026.3.1015", "versionType": "custom"}], "defaultStatus": "unknown"}]}], "published": "2026-10-15T14:17:14.483", "references": [{"url": "https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-scheduler-resource-color-xss-cve-2026-106158", "tags": ["Vendor Advisory"], "source": "security@progress.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "security@progress.com", "description": [{"lang": "en", "value": "CWE-80"}]}], "descriptions": [{"lang": "en", "value": "In Progress\u00ae Kendo\u00ae UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected event is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015."}], "lastModified": "2026-10-20T19:21:09.810", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EE131D36-4BDE-4DB4-9F7B-E73CEB91113D", "versionEndExcluding": "2026.3.1015", "versionStartIncluding": "2014.3.1119"}], "operator": "OR"}]}], "sourceIdentifier": "security@progress.com"}