Cross-site Scripting (XSS) Vulnerability (CVE-2026-106150)
Description
October 2026 - CVE-2026-106150
- Progress® Kendo® UI for jQuery Splitter and Window: versions starting with v2011.2.804 and prior to v2026.3.1015.
- Progress® Kendo® UI for jQuery Tooltip: versions starting with v2013.1.319 and prior to v2026.3.1015.
What Are the Impacts
In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user's browser context, compromising the confidentiality and integrity of accessible data.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and any of the following are true:
- An attacker can control URLs loaded into iframes by Splitter, Window, or Tooltip.
- An attacker can control the Window iframe title.
Issue
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
The affected components insert URL values into single-quoted iframe src attributes without kendo.sanitizeLink. An apostrophe can terminate the attribute value and introduce additional attributes. The Window iframe template also requires encoding of the title value.
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
Splitter and Window: >= 2011.2.804 && <= 2026.3.811 | >= 2026.3.1015 |
Tooltip: >= 2013.1.319 && <= 2026.3.811 | >= 2026.3.1015 |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.
Mitigation
If an immediate upgrade is not possible, apply the following temporary component-specific overrides after loading jQuery and the Kendo UI component scripts and before initializing the affected components.
Splitter
Override kendo.ui.Splitter.fn.ajaxRequest so the iframe markup uses kendo.sanitizeLink(url) for the src value.
(function ($) {
kendo.ui.Splitter.fn.ajaxRequest = function (pane, url, data) {
var that = this,
paneConfig;
pane = that.element.find(pane);
paneConfig = pane.data("pane");
url = url || paneConfig.contentUrl;
if (url) {
pane.append("<span class='k-icon k-i-loading k-pane-loading' />");
if (kendo.isLocalUrl(url)) {
$.ajax({
url: url,
data: data || {},
type: "GET",
dataType: "html",
success: function (data) {
pane.html(data);
that.trigger("contentLoad", { pane: pane[0] });
},
error: function (xhr, status) {
that.trigger("error", {
pane: pane[0],
status: status,
xhr: xhr
});
}
});
} else {
pane.removeClass("k-scrollable")
.html("<iframe src='" + kendo.sanitizeLink(url) + "' frameborder='0' class='k-content-frame'>" +
"This page requires frames in order to show content" +
"</iframe>");
}
}
};
})(jQuery);Tooltip
Override kendo.ui.Tooltip.fn._appendContent and its iframe template so newly created iframe markup uses kendo.sanitizeLink(content.url) for the src value.
(function ($) {
var KCONTENTFRAME = "k-content-frame";
var IFRAMETEMPLATE_SANITIZED = kendo.template(({ content }) =>
`<iframe frameborder='0' class='${KCONTENTFRAME}' src='${kendo.sanitizeLink(content.url)}'>` +
"This page requires frames in order to show content" +
"</iframe>"
);
kendo.ui.Tooltip.fn._appendContent = function (target) {
var that = this,
contentOptions = that.options.content,
element = that.content,
showIframe = that.options.iframe,
iframe;
if ($.isPlainObject(contentOptions) && contentOptions.url) {
if (!("iframe" in that.options)) {
showIframe = !kendo.isLocalUrl(contentOptions.url);
}
that.trigger("requeststart", { options: contentOptions, target: target });
if (!showIframe) {
element.empty();
kendo.ui.progress(element, true);
that._ajaxRequest(contentOptions);
} else {
element.hide();
iframe = element.find("." + KCONTENTFRAME)[0];
if (iframe) {
iframe.src = contentOptions.url === "about:blank" || kendo.sanitizeLink(contentOptions.url) !== "#INVALIDLINK" ? contentOptions.url : "#INVALIDLINK";
} else {
element.html(IFRAMETEMPLATE_SANITIZED({ content: contentOptions }));
}
element.find("." + KCONTENTFRAME)
.off("load.kendoTooltip")
.on("load.kendoTooltip", function () {
that.trigger("contentLoad");
element.show();
});
}
} else if (typeof contentOptions === "function") {
contentOptions = contentOptions({ sender: this, target: target });
element.html(contentOptions || "");
} else {
element.html(contentOptions);
}
};
})(jQuery);Window
Override kendo.ui.Window.fn.refresh and its content iframe template so newly created iframe markup uses kendo.sanitizeLink(content.url) for src and kendo.htmlEncode(title) for title. Only the content iframe template used by this override is included below.
(function ($) {
var template = kendo.template;
function defined(value) {
return typeof value !== "undefined";
}
var templates = {
contentFrame: template(({ title, content }) =>
`<iframe frameborder='0' title='${kendo.htmlEncode(title)}' class='k-content-frame' ` +
`src='${kendo.sanitizeLink(content.url)}'>` +
"This page requires frames in order to show content" +
"</iframe>"
)
};
kendo.ui.Window.fn.refresh = function (options) {
var that = this,
initOptions = that.options,
element = $(that.element),
iframe,
showIframe,
url;
if (!$.isPlainObject(options)) {
options = { url: options };
}
options = $.extend(initOptions.content, options);
showIframe = defined(initOptions.iframe) ? initOptions.iframe : options.iframe;
url = options.url;
if (url) {
if (!defined(showIframe)) {
showIframe = !kendo.isLocalUrl(url);
}
if (!showIframe) {
that._ajaxRequest(options);
} else {
iframe = element.find(".k-content-frame")[0];
if (iframe) {
iframe.src = url === "about:blank" || kendo.sanitizeLink(url) !== "#INVALIDLINK" ? url : "#INVALIDLINK";
} else {
element.html(templates.contentFrame($.extend({}, initOptions, { content: options })));
}
element.find(".k-content-frame")
.off("load.kendoWindow")
.on("load.kendoWindow", that._triggerRefresh.bind(that));
}
} else {
if (options.template) {
that.content(template(options.template)({}));
}
that.trigger("refresh");
}
element.toggleClass("k-window-iframecontent", !!showIframe);
return that;
};
})(jQuery);These overrides depend on internal component methods and the availability of kendo.sanitizeLink. Validate them against the deployed Kendo UI version before use. Upgrading to the fixed release is the recommended solution.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVE-2026-106150 (Medium)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4)
In Progress® Kendo® UI for jQuery prior to 2026.3.811, the Splitter and Window components starting with version 2011.2.804 and the Tooltip component starting with version 2013.1.319 construct iframe markup without properly sanitizing URL values or encoding the Window iframe title. An attacker with low privileges who can control these values can inject HTML attributes, including JavaScript event handlers, through an apostrophe in an iframe URL or a crafted title. When a user interacts with the affected component, injected JavaScript can execute in the user's browser context, compromising the confidentiality and integrity of accessible data.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)