CVE-2026-106153: Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
In Progress® Kendo® UI for jQuery prior to version 2026.3.1015, the Calendar and MultiViewCalendar month content templates render data.url and data.title without proper URL sanitization and HTML attribute encoding. An attacker with low privileges who can control the URL option or culture-derived title values can supply a JavaScript URL or inject event-handler attributes. When a user interacts with an affected calendar, JavaScript can execute in the user's browser context and compromise the confidentiality and integrity of accessible data.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.3.1015
Event History
Frequently Asked Questions
Who is realistically exposed to this issue?
Applications using Kendo UI for jQuery Calendar or MultiViewCalendar before version 2026.3.1015 are exposed if a low-privileged attacker can control the URL option or culture-derived title values used by the calendar month content template.
What must an attacker do to exploit it?
The attacker must be able to supply a malicious data.url or data.title value, such as a JavaScript URL or an event-handler attribute injection payload. A user must then interact with the affected calendar for the injected JavaScript to execute in that user's browser context.
How can I determine whether my application is affected?
Check whether the application uses the Calendar or MultiViewCalendar components in Progress Kendo UI for jQuery before version 2026.3.1015. Then identify whether untrusted users or culture-derived data can influence the URL option or title values rendered by month content templates.
What can be done if updating is not immediately possible?
Prevent low-privileged or untrusted sources from controlling the calendar URL option or culture-derived title values. Validate URLs to disallow JavaScript URLs and ensure title values are safely HTML attribute-encoded before they reach the month content template.