CVE-2026-124695: Cross-Site Scripting in Kendo UI for jQuery Form Item Hints
In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kendo UI for jQuery Formto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
Which deployments are affected?
Progress Kendo UI for jQuery Form deployments using versions from 2020.2.513 through 2026.3.1015 are affected when Form item hints can contain attacker-influenced content. The issue is fixed in version 2026.4.1111.
What must an attacker be able to do to exploit this issue?
An attacker must be able to influence the value assigned to a Form item's items[].hint option. A user must then view the rendered form for the attacker-controlled markup to execute as JavaScript in that user's browser context.
Does exploitation require user interaction?
Yes. The affected form must be viewed by a user. The supplied severity vector indicates that no attacker privileges are required, but user interaction is required.
How can I determine whether my application is exposed?
Review the Kendo UI for jQuery version in use and identify Form implementations that set items[].hint. Applications are exposed where hint values can be influenced by untrusted input and are rendered in an affected version.