CVE-2026-106134: Cross-Site Scripting in Progress Software KendoReact

Published Nov 6, 2026

Updated

Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.

Event History

Nov 6, 2026

CVE Published

via MITRE·04:49 PM

Data Sourced

via MITRE·04:49 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are realistically exposed to this issue?

Applications using @progress/kendo-react-layout versions 1.3.0 through 16.1.0 are exposed when they render Menu item data that a low-privileged attacker can influence. The unsafe URL executes in the application's origin when a user selects the affected Menu item.

What must an attacker be able to do to exploit it?

The attacker needs the ability to influence data used for a Menu item and supply an unsafe URL. Exploitation also requires a user to select that Menu item.

How can I determine whether my application is affected?

Check whether the application uses the Menu component from @progress/kendo-react-layout in versions 1.3.0 through 16.1.0. Then identify whether any low-privileged users can affect Menu item data or URLs that are rendered by the application.

CVE-2026-106134: Cross-Site Scripting in Progress Software KendoReact

Event History

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What must an attacker be able to do to exploit it?

How can I determine whether my application is affected?

Company

Resources

Contact

Frequently Asked Questions

Which applications are realistically exposed to this issue?

What must an attacker be able to do to exploit it?

How can I determine whether my application is affected?