CVE-2026-106149 Cross-site Scripting (XSS) in Kendo UI for jQuery Menu

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-106149

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-106149

Progress® Kendo® UI for jQuery versions prior to v2026.3.1015 are vulnerable to a Cross-site Scripting (XSS) flaw in the Menu component . The root cause is that the component constructs HTML attributes from bound dataSource fields using string concatenation without proper neutralization. An attac...

PT-2026-114941

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...

CVE-2026-106149: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes th...