Medium severity · published Oct 15, 2026
CVE-2026-106149
Cross-site Scripting (XSS) in Kendo UI for jQuery Menu
5.4
CVSS
0.2%
EPSS
No
On KEV
Description
In Progress® Kendo® UI for jQuery prior to v2026.3.1015, the Menu component constructs HTML attributes from bound dataSource fields by string concatenation without proper neutralization. An attacker with low privileges who can control these fields can inject JavaScript event-handler attributes that execute when a user interacts with the affected Menu, compromising the confidentiality and integrity of data accessible in the user's browser context.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
Required
Confidentiality
Low
Integrity
Low
Availability
None
Scope
Changed
Exploitation
Is it being used?
Exploit prediction (EPSS)0.2% · higher than 7% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
KU
Kendo UI for jQuery · Progress Software
2011.2.804 before 2026.3.1015 · source: vendor
KU
Kendo UI · Progress
2011.2.804 before 2026.3.1015 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-106149
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-106149
Vendor Advisory
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-menu-xss-cve-2026-106149
More from Kendo UI for jQuery
7.5
CVE-2026-108116
MDX and SOAP Injection in Kendo UI for jQuery
6.5
CVE-2026-106163
Cross-site Scripting (XSS) in Kendo UI for jQuery FileBrowser and ImageBrowser
5.4
CVE-2026-106153
Cross-site Scripting (XSS) in Kendo UI for jQuery Calendar and MultiViewCalendar
5.4
CVE-2026-106151
Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery
5.4
CVE-2026-106150
Cross-site Scripting (XSS) in Kendo UI for jQuery Splitter, Window, and Tooltip