CVE-2026-106149: Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Progress Kendo UI for jQuery versions prior to v2026.3.1015 are affected when the Menu component builds HTML attributes from bound dataSource fields that can contain attacker-controlled values.
What does an attacker need to exploit this issue?
The attacker needs low-privileged ability to control the relevant Menu dataSource fields. Exploitation also requires a user to interact with the affected Menu.
What is the impact if exploitation succeeds?
Injected JavaScript event-handler attributes can execute in the interacting user's browser. This can compromise the confidentiality and integrity of data accessible in that browser context.