CVE-2026-106150— Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip
Quick assessment
Affected
Progress Software Kendo UI for jQuery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Progress® Kendo® UI for jQuery 2026.3.1015 之前的版本中，自 2011.2.804 版本起引入的 Splitter（分割面板）和 Window（窗口）组件，以及自 2013.1.319 版本起引入的 Tooltip（工具提示）组件，在生成 iframe 标记时未正确对 URL 值进行sanitize（清理/消毒）或未对 Window 组件的 iframe 标题进行适当编码。具备低权限的攻击者若能控制这些值，便可通过 iframe URL 中的单引号或构造的标题注入 HT
Possible ATT&CK Techniques 1 AI
T1189 · Drive-by CompromiseAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2013.1.319< 2026.3.1015 |
affected |
2011.2.804< 2026.3.1015 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106150
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user's browser context, compromising the confidentiality and integrity of accessible data.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
在Web页面生成时对输入的转义处理不恰当(跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2013.1.319 ~ 2026.3.1015 | - |
|
II. Public POCs for CVE-2026-106150
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106150
请登录查看更多情报信息。
Same Patch Batch · Progress Software · 2026-10-15 · 14 CVEs total
| CVE-2026-108116 | 7.5 HIGH | MDX and SOAP Injection in Kendo UI for jQuery |
| CVE-2026-106163 | 6.5 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser |
| CVE-2026-106161 | 5.4 MEDIUM | Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery |
| CVE-2026-106160 | 5.4 MEDIUM | Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery |
| CVE-2026-106147 | 5.4 MEDIUM | Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery |
| CVE-2026-106148 | 5.4 MEDIUM | Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery |
| CVE-2026-106153 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar |
| CVE-2026-106149 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Menu |
| CVE-2026-106151 | 5.4 MEDIUM | Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery |
| CVE-2026-106162 | 4.7 MEDIUM | Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery |
| CVE-2026-106157 | 4.7 MEDIUM | Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery |
| CVE-2026-106158 | 4.7 MEDIUM | Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery |
| CVE-2026-106159 | 4.7 MEDIUM | Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery |
IV. Related Vulnerabilities
Same product: Kendo UI for jQuery
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu -
CVE-2026-106148
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image
Same vendor: Progress Software
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu -
CVE-2026-106148
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image
Same weakness: CWE-79
-
CVE-2026-103481
Gwolle Guestbook <= 5.1.1 - Reflected Cross-Site Scripting v -
CVE-2026-109998
Mang Board <= 2.4.3 - Unauthenticated Stored Cross-Site Scri -
CVE-2026-109512
Mang Board <= 2.4.4 - Authenticated (Subscriber+) Stored Cro -
CVE-2026-107758
Colibri Page Builder <= 1.0.390 - Unauthenticated Stored Cro -
CVE-2026-109207
RSS Aggregator by Feedzy <= 5.2.11 - Unauthenticated Stored
V. Comments for CVE-2026-106150
No comments yet