CVE-2026-124694: Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions

Published Nov 11, 2026

Updated

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Kendo UI for jQuery to a version that resolves this vulnerability.
Fixed in 2026.4.1110

Event History

Nov 11, 2026

CVE Published

via MITRE·04:57 PM

Data Sourced

via MITRE·04:57 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Which deployments are exposed?

Deployments using Kendo UI for jQuery PropertyGrid are exposed if they run versions 2026.3.1015 through versions before 2026.4.1110 and render attacker-influenced bound property values or items[].description using the default configuration.

What does an attacker need to exploit this issue?

An attacker must be able to influence a property value bound to the PropertyGrid or an items[].description value. They also need a user to view the affected grid for the injected JavaScript to execute in that user's browser context.

Is the default PropertyGrid configuration affected?

Yes. The affected versions do not encode bound property values and items[].description in the default configuration.

What can be done if updating is not immediately possible?

Prevent untrusted input from reaching PropertyGrid bound values and items[].description, or ensure those values are encoded before they are rendered. Review any data sources that can populate these fields with user-controlled content.

How can teams identify potentially affected instances?

Identify applications using Kendo UI for jQuery PropertyGrid in versions 2026.3.1015 through before 2026.4.1110, then check whether bound values or items[].description can contain attacker-controlled data. The first affected release has not been established.

CVE-2026-124694: Cross-Site Scripting in Kendo UI for jQuery PropertyGrid Values and Descriptions

Remediation

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Is the default PropertyGrid configuration affected?

What can be done if updating is not immediately possible?

How can teams identify potentially affected instances?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this issue?

Is the default PropertyGrid configuration affected?

What can be done if updating is not immediately possible?

How can teams identify potentially affected instances?