Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization (CVE-2026-124690)
Description
November 2026 - CVE-2026-124690
What Are the Impacts
An attacker who can influence custom icon content passed to Kendo UI for jQuery can cause JavaScript to execute when the icon is created. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and allows an attacker to control custom icon content.
Issue
- CWE classification: CWE-79, Improper Neutralization of Input During Web Page Generation (Cross-site Scripting).
- CAPEC classification: CAPEC-63, Cross-Site Scripting (XSS).
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
Reported version: 2026.3.1015; affected range not established | >= 2026.4.1111 |
Follow the Kendo UI for jQuery update instructions. Licensed customers can access Product Downloads | Your Account.
Notes
- If you have questions about this issue, open a Technical Support case in Your Account | Support Center.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVSS: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N (4.7)
In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1111.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)