Cross-Site Scripting in Kendo UI for jQuery ActionSheet Header Labels (CVE-2026-124689)
Description
November 2026 - CVE-2026-124689
What Are the Impacts
An attacker who can influence ActionSheet title, subtitle, or header button label values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and allows an attacker to control ActionSheet title, subtitle, or start/close button text values.
Issue
- CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
- CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
Reported version: 2026.3.1015; affected range not established | >= 2026.4.1111 |
Follow the Kendo UI for jQuery update instructions. Licensed customers can access Product Downloads | Your Account.
Notes
- If you have questions about this issue, open a Technical Support case in Your Account | Support Center.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7).
In Progress Kendo UI for jQuery, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)