CVE-2026-106158: Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery, in v2026.3.811 and earlier, the Scheduler Day, Timeline, Month, and Agenda views insert resource color values into quoted event wrapper attributes without proper encoding. An attacker who can control a resource color can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected event is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.3.1015
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Progress Kendo UI for jQuery Scheduler Day, Timeline, Month, or Agenda views are exposed if an attacker can control resource color values. Users who interact with affected scheduled events may execute the injected JavaScript in their browser.
What does an attacker need to exploit it?
The attacker needs the ability to supply or modify a Scheduler resource color value. Exploitation also requires a user to interact with an affected event after the malicious color is rendered.
Are default deployments known to be affected?
The available information does not establish whether default configurations allow untrusted users to control resource color values. Exposure depends on how the application sources and authorizes Scheduler resource color data.
What version fixes the issue?
The issue is fixed in Progress Kendo UI for jQuery version 2026.3.1015. Versions 2026.3.811 and earlier are affected; the earliest affected version is not confirmed.
What can be done if updating is not immediately possible?
Prevent untrusted users from controlling Scheduler resource color values, and validate or restrict those values before they reach the affected Scheduler views. Review resource-color management paths and permissions to identify whether users can inject arbitrary attribute content.