CVE-2026-106160

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing proto, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype...

CVE-2026-106160

Progress Kendo UI for jQuery versions prior to 2026.3.1015 are vulnerable to Prototype Pollution via Model.accept and kendo.setter. The root cause is a failure to guard against unsafe object paths containing __proto__, constructor, or prototype when processing server-response keys. An attacker pr...