CVE-2026-106144: Prototype Pollution in Progress Software Kendo UI for Angular

Published Nov 6, 2026

Updated

Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @progress/kendo-angular-scheduler and @progress/kendo-angular-common to a version that resolves this vulnerability.
Fixed in 25.1.0

Event History

Nov 6, 2026

CVE Published

via MITRE·04:59 PM

Data Sourced

via MITRE·04:59 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is realistically exposed to this issue?

Applications using the Kendo UI for Angular Scheduler component and the @progress/kendo-angular-common package in versions earlier than 25.1.0 are affected if a high-privileged user can control a field path that the Scheduler processes.

What level of access does an attacker need?

The attacker must be high privileged and able to control a field path processed by the Scheduler. The provided information does not indicate that an unauthenticated or low-privileged user can exploit it.

What is the remediation?

Upgrade the affected Kendo UI for Angular packages to version 25.1.0 or later. The affected packages are @progress/kendo-angular-scheduler and @progress/kendo-angular-common.

What can be done if an immediate upgrade is not possible?

Restrict and validate field paths supplied to the Scheduler, particularly for high-privileged users. Prevent user-controlled paths from modifying object prototype properties.

CVE-2026-106144: Prototype Pollution in Progress Software Kendo UI for Angular

Remediation

Event History

Frequently Asked Questions

Who is realistically exposed to this issue?

What level of access does an attacker need?

What is the remediation?

What can be done if an immediate upgrade is not possible?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What level of access does an attacker need?

What is the remediation?

What can be done if an immediate upgrade is not possible?