CVE-2026-106134— Cross-Site Scripting in Progress Software KendoReact
Quick assessment
Affected
Progress Software KendoReact
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Progress Software KendoReact 的 Menu 组件（@progress/kendo-react-layout）在 1.3.0 至 16.1.0 版本中存在跨站脚本（XSS）漏洞。该漏洞允许低权限攻击者通过操控菜单项数据，在菜单项中植入不安全的 URL；当用户选中该菜单项时，攻击者即可在应用程序的源站上下文中执行任意 JavaScript 代码。
Possible ATT&CK Techniques 1 AI
T1190 · Exploit Public-Facing Application
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106134
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-Site Scripting in Progress Software KendoReact
Source: CVE Program / CVE List V5
Vulnerability Description
Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | KendoReact | 1.3.0 ~ 16.2.0 | - |
|
II. Public POCs for CVE-2026-106134
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106134
请登录查看更多情报信息。
Other References for CVE-2026-106134 (1)
Same Patch Batch · Progress Software · 2026-11-06 · 11 CVEs total
| CVE-2026-104657 | 7.5 HIGH | Missing Integrity Verification in Progress Software Fiddler Download & Setup Skill |
| CVE-2026-104656 | 7.3 HIGH | Cross-site Scripting in Progress Telerik Fiddler Everywhere |
| CVE-2026-106135 | 5.4 MEDIUM | Cross-Site Scripting in Progress Software Kendo UI for Angular |
| CVE-2026-106143 | 5.4 MEDIUM | Cross-Site Scripting in Progress Software Kendo UI for Vue |
| CVE-2026-106136 | 5.4 MEDIUM | Cross-Site Scripting in Progress Software KendoReact |
| CVE-2026-106142 | 5.4 MEDIUM | Cross-Site Scripting in Progress Software KendoReact |
| CVE-2026-106141 | 5.4 MEDIUM | Cross-Site Scripting in Progress Software Kendo UI for Angular |
| CVE-2026-106128 | 4.1 MEDIUM | Prototype Pollution in Progress Software Kendo UI for Vue |
| CVE-2026-106144 | 4.1 MEDIUM | Prototype Pollution in Progress Software Kendo UI for Angular |
| CVE-2026-106127 | 4.1 MEDIUM | Prototype Pollution in Progress Software KendoReact |
IV. Related Vulnerabilities
Same vendor: Progress Software
-
CVE-2026-106128
Prototype Pollution in Progress Software Kendo UI for Vue -
CVE-2026-106127
Prototype Pollution in Progress Software KendoReact -
CVE-2026-106144
Prototype Pollution in Progress Software Kendo UI for Angula -
CVE-2026-106143
Cross-Site Scripting in Progress Software Kendo UI for Vue -
CVE-2026-106142
Cross-Site Scripting in Progress Software KendoReact
Same weakness: CWE-79
-
CVE-2026-62346
Wanderer: Stored XSS via waypoint.name and waypoint.icon in -
CVE-2026-62345
Stored XSS via Unsanitized waypoint.icon in Map Marker (inse -
CVE-2026-118670
OHIF Viewers: DOM-Based Cross Site Scripting (XSS) through M -
CVE-2026-85742
FreeScout: Conditional stored admin XSS via failed-job detai -
CVE-2026-106143
Cross-Site Scripting in Progress Software Kendo UI for Vue