CVE-2026-106151— Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
Quick assessment
Affected
Progress Software Kendo UI for jQuery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
In Progress Kendo UI for jQuery 版本中，自 2012.2.710 至 2026.3.1015（不包括该版本），Validator 组件会从 data-msg-* 属性中解码验证消息，并将解析后的文本作为 HTML 进行渲染。如果攻击者能够篡改验证消息，则原本在页面属性中被正确转义的 HTML 内容会在用户触发验证时变成可执行的标记（如事件处理器），从而可能导致在用户浏览器中执行 JavaScript 代码，进而影响受影响应用可访问数据的机密性和完整性。此问题已在版本 2026.3.1
Possible ATT&CK Techniques 2 AI
T1189 · Drive-by Compromise T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2012.2.710< 2026.3.1015 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106151
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.1015, the Validator decodes validation messages from data-msg-* attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user's browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2012.2.710 ~ 2026.3.1015 | - |
|
II. Public POCs for CVE-2026-106151
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106151
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-106151 (1)
Same Patch Batch · Progress Software · 2026-10-15 · 14 CVEs total
| CVE-2026-108116 | 7.5 HIGH | MDX and SOAP Injection in Kendo UI for jQuery |
| CVE-2026-106163 | 6.5 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser |
| CVE-2026-106161 | 5.4 MEDIUM | Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery |
| CVE-2026-106160 | 5.4 MEDIUM | Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery |
| CVE-2026-106147 | 5.4 MEDIUM | Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery |
| CVE-2026-106148 | 5.4 MEDIUM | Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery |
| CVE-2026-106153 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar |
| CVE-2026-106149 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Menu |
| CVE-2026-106150 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip |
| CVE-2026-106162 | 4.7 MEDIUM | Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery |
| CVE-2026-106157 | 4.7 MEDIUM | Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery |
| CVE-2026-106158 | 4.7 MEDIUM | Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery |
| CVE-2026-106159 | 4.7 MEDIUM | Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery |
IV. Related Vulnerabilities
Same product: Kendo UI for jQuery
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu -
CVE-2026-106148
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image
Same vendor: Progress Software
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu -
CVE-2026-106148
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image
Same weakness: CWE-80
-
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu -
CVE-2026-106148
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image -
CVE-2026-106147
Cross-Site Scripting via ListBox Bound Text in Kendo UI for -
CVE-2026-106161
Cross-Site Scripting via Badge Text Binding in Kendo UI for -
CVE-2026-106159
Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo U
V. Comments for CVE-2026-106151
No comments yet