CVE-2026-106148— Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery
Quick assessment
Affected
Progress Software Kendo UI for jQuery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Progress® Kendo® UI for jQuery 2026.3.1015 之前的版本中，TabStrip、Menu 和 PanelBar 组件将数据源中的 imageUrl 值插入到单引号包围的 img src 属性中时，未进行适当的转义处理。攻击者若能够修改图像 URL，便可以在渲染受影响组件的图像时注入额外的 HTML 属性（包括事件处理程序），从而在用户的浏览器中执行 JavaScript 代码。成功利用此漏洞可能损害受影响应用程序所访问数据的机密性和完整性。尚未确认最早受影响的版本。该问题已
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2011.2.804< 2026.3.1015 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106148
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected component renders the image. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2011.2.804 ~ 2026.3.1015 | - |
|
II. Public POCs for CVE-2026-106148
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106148
请登录查看更多情报信息。
Other References for CVE-2026-106148 (1)
Same Patch Batch · Progress Software · 2026-10-15 · 14 CVEs total
| CVE-2026-108116 | 7.5 HIGH | MDX and SOAP Injection in Kendo UI for jQuery |
| CVE-2026-106163 | 6.5 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser |
| CVE-2026-106161 | 5.4 MEDIUM | Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery |
| CVE-2026-106160 | 5.4 MEDIUM | Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery |
| CVE-2026-106147 | 5.4 MEDIUM | Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery |
| CVE-2026-106153 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar |
| CVE-2026-106149 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Menu |
| CVE-2026-106151 | 5.4 MEDIUM | Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery |
| CVE-2026-106150 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip |
| CVE-2026-106162 | 4.7 MEDIUM | Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery |
| CVE-2026-106157 | 4.7 MEDIUM | Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery |
| CVE-2026-106158 | 4.7 MEDIUM | Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery |
| CVE-2026-106159 | 4.7 MEDIUM | Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery |
IV. Related Vulnerabilities
Same product: Kendo UI for jQuery
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Same vendor: Progress Software
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Same weakness: CWE-80
-
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu -
CVE-2026-106147
Cross-Site Scripting via ListBox Bound Text in Kendo UI for -
CVE-2026-106161
Cross-Site Scripting via Badge Text Binding in Kendo UI for -
CVE-2026-106159
Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo U
V. Comments for CVE-2026-106148
No comments yet