Medium severity · published Oct 15, 2026
CVE-2026-106147
Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KU
Kendo UI for jQuery · Progress Software
2020.1.114 before 2026.3.1015 · source: vendor
KU
Kendo UI · Progress
2020.1.114 before 2026.3.1015 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106147
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106147
Vendor Advisory
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-listbox-bound-text-xss-cve-2026-106147
More from Kendo UI for jQuery
7.5
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery
6.5
CVE-2026-106163
Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
5.4
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
5.4
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
5.4
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip