CVE-2026-106161— Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery
Quick assessment
Affected
Progress Software Kendo UI for jQuery
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
在 Progress® Kendo® UI for jQuery 从 v2020.1.114 至 v2026.3.1015（不含 v2026.3.1015）的版本中，Badge 组件的 text 方法会将字符串值作为原始 HTML 进行渲染，而不会进行编码处理，这包括通过文本绑定（text binding）传入的值。攻击者若能够修改绑定到 Badge 的数据，即可注入包含事件处理程序的 HTML，当 Badge 渲染该值时，会在用户浏览器中执行 JavaScript。成功利用此漏洞可能损害受影响应用可访问数据的机密
Possible ATT&CK Techniques 1 AI
T1059 · Command and Scripting InterpreterAffected Version Matrix 1
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2020.1.114< 2026.3.1015 |
affected |
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-106161
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery
Source: CVE Program / CVE List V5
Vulnerability Description
In Progress® Kendo® UI for jQuery releases starting with v2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing event handlers that execute JavaScript in a user's browser when the Badge renders the value. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
Web页面中脚本相关HTML标签转义处理不恰当(基本跨站脚本)
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Progress Software | Kendo UI for jQuery | 2020.1.114 ~ 2026.3.1015 | - |
|
II. Public POCs for CVE-2026-106161
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-106161
请登录查看更多情报信息。
Other References for CVE-2026-106161 (1)
Same Patch Batch · Progress Software · 2026-10-15 · 14 CVEs total
| CVE-2026-108116 | 7.5 HIGH | MDX and SOAP Injection in Kendo UI for jQuery |
| CVE-2026-106163 | 6.5 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser |
| CVE-2026-106160 | 5.4 MEDIUM | Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery |
| CVE-2026-106147 | 5.4 MEDIUM | Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery |
| CVE-2026-106148 | 5.4 MEDIUM | Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery |
| CVE-2026-106153 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar |
| CVE-2026-106149 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Menu |
| CVE-2026-106151 | 5.4 MEDIUM | Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery |
| CVE-2026-106150 | 5.4 MEDIUM | Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip |
| CVE-2026-106162 | 4.7 MEDIUM | Cross-Site Scripting in FileManager Drag Hints in Kendo UI for jQuery |
| CVE-2026-106157 | 4.7 MEDIUM | Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery |
| CVE-2026-106158 | 4.7 MEDIUM | Cross-Site Scripting via Scheduler Resource Colors in Kendo UI for jQuery |
| CVE-2026-106159 | 4.7 MEDIUM | Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery |
IV. Related Vulnerabilities
Same product: Kendo UI for jQuery
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Same vendor: Progress Software
-
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery -
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar a -
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
Same weakness: CWE-80
-
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Ken -
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu -
CVE-2026-106148
Cross-Site Scripting via TabStrip, Menu, and PanelBar Image -
CVE-2026-106147
Cross-Site Scripting via ListBox Bound Text in Kendo UI for -
CVE-2026-106159
Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo U
V. Comments for CVE-2026-106161
No comments yet