CVE-2026-106161: Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing event handlers that execute JavaScript in a user's browser when the Badge renders the value. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.3.1015
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using Progress Kendo UI for jQuery versions from 2020.1.114 through versions before 2026.3.1015 are exposed if untrusted or attacker-modifiable data is bound to a Badge's text.
What does an attacker need to exploit it?
The attacker must be able to modify a value that is data-bound to a Kendo UI Badge. They can then supply HTML with event handlers, which executes in a user's browser when the Badge renders the value; user interaction is required.
Are applications affected by default?
The issue applies to the Badge text method because it renders string values as raw HTML without encoding. Exposure depends on whether the application binds attacker-controlled data to Badge text.
What is the remediation?
Upgrade to Kendo UI for jQuery version 2026.3.1015, which fixes the issue. If upgrading is not immediately possible, do not bind untrusted or attacker-modifiable values to Badge text.