CVE-2026-124687: Cross-Site Scripting in DropDownButton and SplitButton Items in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
Which deployments are affected?
Kendo UI for jQuery versions from 2022.2.621 up to, but not including, 2026.4.1111 are affected when using the DropDownButton or SplitButton with attacker-influenced item id or target values.
What must an attacker be able to control?
An attacker must be able to influence the id or target attributes assigned to DropDownButton or SplitButton items. They can use crafted values to break out of the intended attributes and inject markup, including event handlers.
Does exploitation require authentication or user interaction?
The supplied severity vector indicates no privileges are required by the attacker, but user interaction is required. The vulnerability is remotely exploitable with low attack complexity.
What version fixes the issue?
Upgrade Kendo UI for jQuery to version 2026.4.1111 or later. This version contains the fix for markup injection through DropDownButton and SplitButton item id and target attributes.