CVE-2026-124696: Cross-Site Scripting in Kendo UI for jQuery Spreadsheet Sheet Names
In Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kendo UI for jQueryto a version that resolves this vulnerability.Fixed in 2026.4.1111
Event History
Frequently Asked Questions
Who is exposed to this issue?
Applications using affected Progress Kendo UI for jQuery versions that render Spreadsheet sheet names in the SheetsBar menu are exposed when an attacker can influence a sheet name. Exploitation occurs in the browser of a user who hovers over the affected menu button.
What does an attacker need to exploit it?
The attacker needs the ability to supply or modify a Spreadsheet sheet name containing an event-handler attribute payload. No authentication is required by the vulnerability itself, but a user must interact with the SheetsBar menu button by hovering over it.
Which versions are affected and which version fixes the issue?
The affected range begins with version 2024.4.1112 and extends through version 2026.3.1015. The issue is fixed in version 2026.4.1111.
What is the impact if exploitation succeeds?
Injected JavaScript executes in the affected user's browser context. This may compromise the confidentiality and integrity of data available to that user in the browser.