CVE-2026-106148: fallo de gravedad media en Progress Software Kendo UI for jQuery
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery
Publicada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
13Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackcvss 5.4epss 0.2%
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected component renders the image. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Productos afectados
Progress Software · Kendo UI for jQueryCVEs relacionadas — Progress Software Kendo UI for jQuery
En el mismo producto, de las más peligrosas a las menos.
CVE-2025-6725MEDIUMCross-Site Scripting (XSS) in PdfViewerEPSS 0.3%CVE-2026-108116HIGHMDX and SOAP Injection in Kendo UI for jQueryEPSS 0.3%CVE-2026-106160MEDIUMPrototype Pollution via Model.accept and kendo.setter in Kendo UI for jQueryEPSS 0.2%CVE-2026-106163MEDIUMCross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowserEPSS 0.2%CVE-2026-106153MEDIUMCross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendarEPSS 0.2%CVE-2026-106151MEDIUMCross-Site Scripting in Validator Validation Messages in Kendo UI for jQueryEPSS 0.2%