Cross-Site Scripting in Kendo UI for jQuery PivotGrid Axis Chips (CVE-2026-124693)
Description
November 2026 - CVE-2026-124693
What Are the Impacts
An attacker who can influence an axis field name used by an affected PivotGrid or PivotConfigurator can cause JavaScript to execute when a user views the rendered axis chip. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and allows an attacker to control axis field names used by PivotGrid or PivotConfigurator.
Issue
- CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
- CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
Reported version: 2026.3.1015; affected range not established | >= 2026.4.1111 |
Follow the Kendo UI for jQuery update instructions. Licensed customers can access Product Downloads | Your Account.
Notes
- If you have questions about this issue, open a Technical Support case in Your Account | Support Center.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7)
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1111, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)