CVE-2026-124690

In Progress Kendo UI for jQuery, sanitizeSvgContent parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version...

CVE-2026-124690

In Progress Kendo UI for jQuery, sanitizeSvgContent parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version...

CVE-2026-124690 Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization

In Progress Kendo UI for jQuery, sanitizeSvgContent parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version...

EUVD-2026-123600

In Progress Kendo UI for jQuery, sanitizeSvgContent parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version...

CVE-2026-124690

The Kendo UI for jQuery component is vulnerable to Cross-Site Scripting (XSS) due to how the sanitizeSvgContent() function handles custom icon markup. The root cause is that the function parses the markup into a live DOM before performing filtering, allowing an attacker who can influence the cont...

PT-2026-145277

In Progress Kendo UI for jQuery, sanitizeSvgContent parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version...

CVE-2026-124690: Progress Software Kendo UI for jQuery: In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it

In Progress Kendo UI for jQuery, sanitizeSvgContent parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version...