CVE-2026-124692: Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering

Published Nov 11, 2026

Updated

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kendo UI for jQuery to a version that resolves this vulnerability.
Fixed in 2026.4.1110

Event History

Nov 11, 2026

CVE Published

via MITRE·04:52 PM

Data Sourced

via MITRE·04:52 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which applications are exposed to this issue?

Applications using affected Kendo UI for jQuery releases are exposed when they use the Grid or TreeList, have column reordering enabled, and allow an attacker to influence a column field or title. The vulnerable behavior is triggered through the column-reorder drag clue.

What user action is required for exploitation?

A user must drag a column header while column reordering is enabled. The attacker does not need privileges, but must first be able to place malicious HTML in a column field or title used by the application.

Which versions should be remediated?

Versions from 2026.3.1015 up to, but excluding, 2026.4.1110 are affected. The first affected release has not been established, so deployments earlier than 2026.3.1015 cannot be classified as unaffected from the available information.

What can be done if upgrading is not immediately possible?

Disable column reordering for affected Grid and TreeList instances, or prevent untrusted input from being used as column field names or titles. This removes the described trigger or the attacker-controlled HTML source.

CVE-2026-124692: Cross-Site Scripting in Kendo UI for jQuery Grid and TreeList Column Reordering

Remediation

Event History

Frequently Asked Questions

Which applications are exposed to this issue?

What user action is required for exploitation?

Which versions should be remediated?

What can be done if upgrading is not immediately possible?

Company

Resources

Contact

Frequently Asked Questions

Which applications are exposed to this issue?

What user action is required for exploitation?

Which versions should be remediated?

What can be done if upgrading is not immediately possible?