Cross-Site Scripting via Badge Text Binding in Kendo UI for jQuery (CVE-2026-106161)

Updated on Oct 14, 2026

Description

October 2026 - CVE-2026-106161

• Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.

What Are the Impacts

The Badge text() method renders string values as raw HTML, including values supplied through text binding. An attacker who can modify the bound data can introduce HTML containing event handlers. JavaScript can execute in a user's browser when the Badge renders the value, compromising the confidentiality and integrity of data accessible to the affected application.

Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version and passes attacker-controlled values to the Badge text() method, directly or through text binding.

Issue

• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CAPEC-18: XSS Targeting Non-Script Elements

Solution

The issue is fixed in version 2026.3.1015. The Progress Telerik team strongly recommends upgrading to this version or later.

Current Version	Update to
>= 2020.1.114 && <= 2026.3.811	>= 2026.3.1015

Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, apply the following temporary string-encoding override after loading Kendo UI and before initializing the affected Badge widgets or MVVM bindings. It preserves the original getter and numeric behavior while encoding string values.

javascript

const originalBadgeText = kendo.ui.Badge.fn.text;

kendo.ui.Badge.fn.text = function(text) {
	if (arguments.length === 0 || text === undefined) {
		return originalBadgeText.call(this);
	}
	if (typeof text === "string") {
		this._text = text;
		this.element.html(kendo.htmlEncode(text));
		return;
	}
	if (typeof text === "object" && text !== null) {
		throw new TypeError("Badge text must be a primitive value.");
	}
	return originalBadgeText.call(this, text);
};

An override that encodes only strings leaves the object toString() branch rendering raw HTML. The override above rejects object values to avoid that remaining path. Convert legitimate object-backed values to plain strings before passing them to the Badge. Apply the override only once and test direct updates, MVVM updates, initial rendering, and numeric maximum behavior with your installed version. Use only trusted initial content or disable the Badge if a rendering path bypasses the overridden method. This workaround does not preserve intentionally rendered HTML; upgrading is the preferred solution.

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.

External References

CVE-2026-106161 (Medium)

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4)

In Progress® Kendo® UI for jQuery releases starting with 2020.1.114 and prior to 2026.3.1015, the Badge text method renders string values as raw HTML without encoding, including values supplied through text binding. An attacker who can modify data bound to a Badge can supply HTML containing event handlers that execute JavaScript in a user's browser when the Badge renders the value. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)