CVE-2026-106160: Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing proto, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Progress Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.3.1015
Event History
Frequently Asked Questions
Which deployments are affected?
Progress Kendo UI for jQuery versions before 2026.3.1015 are affected. The earliest affected version has not been confirmed.
What must an attacker be able to do to exploit this issue?
An attacker must be able to supply data that is accepted by an affected model and persuade a user to interact with the application. Exploitation uses server-response keys containing unsafe paths such as __proto__, constructor, or prototype.
Are all applications using the affected component exposed to the same impact?
No. The practical impact depends on how the application uses objects whose prototypes were modified; server-side JavaScript usage can increase the consequences. The reported potential impact is modification of application behavior affecting confidentiality and integrity.
What is the remediation?
Upgrade to Kendo UI for jQuery version 2026.3.1015, which fixes the issue.