CVE-2026-106128: Prototype Pollution in Progress Software Kendo UI for Vue

Published Nov 6, 2026

Updated

Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

Event History

Nov 6, 2026

CVE Published

via MITRE·05:01 PM

Data Sourced

via MITRE·05:01 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Applications using @progress/kendo-vue-common versions 0.4.0 through 9.2.0 are exposed when they use components that process attacker-controlled field paths, such as the Scheduler. Exploitation requires a high-privileged attacker.

What does an attacker need to exploit the vulnerability?

The attacker must be able to control a field path that is processed by an affected component. The reported impact is modification of built-in object prototypes, with limited effects on confidentiality, integrity, and availability.

CVE-2026-106128: Prototype Pollution in Progress Software Kendo UI for Vue

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What does an attacker need to exploit the vulnerability?