CVE-2026-124688: Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery
In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to spriteCssClass. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.
Event History
Frequently Asked Questions
Which applications are exposed to this issue?
Applications using Kendo UI for jQuery TabStrip, PanelBar, or Menu widgets are exposed when they map attacker-controllable data to the spriteCssClass field. The issue affects versions prior to 2026.4.1111.
What must an attacker do to exploit the vulnerability?
The attacker must be able to control data mapped to spriteCssClass. A victim must then load a page that renders an affected widget containing the crafted value.
What can successful exploitation allow?
Injected JavaScript executes in the application's origin and can access data and perform actions available to the victim's authenticated session. The described impact includes confidentiality, integrity, and availability effects.