CVE-2026-106160— Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery
Quick assessment
Affected
Progress Software Kendo UI for jQuery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Progress® Kendo® UI for jQuery 早于 2026.3.1015 版本的软件中， 方法会将对服务器响应中的键传递给 ，但未对包含 、 或 的不安全对象路径进行防护。攻击者若能提供被受影响模型接受的数据，即可修改对象原型属性，从而影响应用程序行为，可能导致应用程序数据的机密性和完整性遭到破坏。该漏洞的实际影响程度取决于应用程序如何使用这些被修改的对象，包括在服务器端 JavaScript 场景中的使用方式。尚未确认最早受影响的版本。此问题已在版本 2026.3.1015 中得到修复。
Possible ATT&CK Techniques 1 AI
T1059.007 · JavaScriptAffected Version Matrix 2
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2023.1.117< 2026.3.1015 |
affected |
2026.3.1015 |
unaffected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106160
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
CWE-1321
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2023.1.117 ~ 2026.3.1015 | - |
|
II. Public POCs for CVE-2026-106160
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106160
请登录查看更多情报信息。
Other References for CVE-2026-106160 (1)
Same Patch Batch · Progress Software · 2026-10-15 · 14 CVEs total
| CVE-2026-108116 | 7.5 HIGH | MDX and SOAP Injection in Kendo UI for jQuery |
| CVE-2026-106163 | 6.5 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser |
| CVE-2026-106161 | 5.4 MEDIUM | Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery |
| CVE-2026-106147 | 5.4 MEDIUM | Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery |
| CVE-2026-106148 | 5.4 MEDIUM | Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery |
| CVE-2026-106153 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar |
| CVE-2026-106149 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Menu |
| CVE-2026-106151 | 5.4 MEDIUM | Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery |
| CVE-2026-106150 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip |
| CVE-2026-106162 | 4.7 MEDIUM | Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery |
| CVE-2026-106157 | 4.7 MEDIUM | Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery |
| CVE-2026-106158 | 4.7 MEDIUM | Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery |
| CVE-2026-106159 | 4.7 MEDIUM | Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery |
IV. Related Vulnerabilities
Same product: Kendo UI for jQuery
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Same vendor: Progress Software
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Same weakness: CWE-1321
-
CVE-2026-111172
@casl/ability 6.7.5 before 7.0.2 Prototype Pollution via rul -
CVE-2026-110848
n8n before 1.123.83, 2.41.4, and 2.42.1 Prototype Pollution -
CVE-2026-110842
n8n before 2.41.4 and 2.42.1 Prototype Pollution via MCP Wor -
CVE-2026-110111
Xen Orchestra before 6.9.0 Privilege Escalation via Prototyp -
CVE-2026-109758
Perforce HAS 2022.1-2025.2 默认凭证致未授权访问
V. Comments for CVE-2026-106160
No comments yet