CVE-2026-106147— Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery
Quick assessment
Affected
Progress Software Kendo UI for jQuery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 In Progress® Kendo® UI for jQuery 从 R1 2020 到 2026.3.1015 版本（包含 R1 2020，不包含 2026.3.1015）中，ListBox 的默认项目模板未对绑定的 dataTextField 值进行 HTML 编码，而是直接将其作为原始 HTML 渲染。如果攻击者能够篡改绑定的数据，可以注入包含事件处理程序的 HTML，从而在浏览器渲染受影响列表项时执行恶意 JavaScript 代码。成功利用此漏洞可能导致受影响应用程序可访问数据的机密性和完整性遭到破
Affected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2020.1.114< 2026.3.1015 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106147
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2020.1.114 ~ 2026.3.1015 | - |
|
II. Public POCs for CVE-2026-106147
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106147
请登录查看更多情报信息。
Other References for CVE-2026-106147 (1)
Same Patch Batch · Progress Software · 2026-10-15 · 14 CVEs total
| CVE-2026-108116 | 7.5 HIGH | MDX and SOAP Injection in Kendo UI for jQuery |
| CVE-2026-106163 | 6.5 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser |
| CVE-2026-106161 | 5.4 MEDIUM | Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery |
| CVE-2026-106160 | 5.4 MEDIUM | Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery |
| CVE-2026-106148 | 5.4 MEDIUM | Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery |
| CVE-2026-106153 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar |
| CVE-2026-106149 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Menu |
| CVE-2026-106151 | 5.4 MEDIUM | Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery |
| CVE-2026-106150 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip |
| CVE-2026-106162 | 4.7 MEDIUM | Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery |
| CVE-2026-106157 | 4.7 MEDIUM | Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery |
| CVE-2026-106158 | 4.7 MEDIUM | Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery |
| CVE-2026-106159 | 4.7 MEDIUM | Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery |
IV. Related Vulnerabilities
Same product: Kendo UI for jQuery
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Same vendor: Progress Software
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Same weakness: CWE-80
-
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu -
CVE-2026-106148
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image -
CVE-2026-106161
Cross-Site Scripting via Badge Text Binding in Kendo UI for -
CVE-2026-106159
Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo U
V. Comments for CVE-2026-106147
No comments yet