Cross-Site Scripting via ListBox Bound Text in Kendo UI for jQuery (CVE-2026-106147)

Updated on Oct 14, 2026

Description

October 2026 - CVE-2026-106147

• Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.

What Are the Impacts

The ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can introduce HTML containing event handlers. JavaScript can execute in a user's browser when the affected list item is rendered, compromising the confidentiality and integrity of data accessible to the affected application.

Is My Application Vulnerable?

Your application may be vulnerable if it uses an affected version and displays attacker-controlled dataTextField values through the ListBox default item template.

Issue

• CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
• CAPEC-18: XSS Targeting Non-Script Elements

Solution

We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.

Current Version	Update to
>= 2020.1.114 && <= 2026.3.811	>= 2026.3.1015

Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.

Mitigation

If an immediate upgrade is not possible, apply the following temporary _templates override after loading Kendo UI and before initializing the affected ListBox widgets. It HTML-encodes the dataTextField value in the default item template.

javascript

kendo.ui.ListBox.fn._templates = function() {
	var that = this,
		options = this.options,
		template;
	if (options.template && typeof options.template === "string") {
		template = kendo.template(options.template);
	} else if (!options.template) {
		template = kendo.template((data) =>
			`${kendo.htmlEncode(kendo.getter(options.dataTextField)(data))}`
		);
	} else {
		template = options.template;
	}
	that.templates = {
		itemTemplate: kendo.template(({ item, r: render }) =>
			`<li class='k-list-item' role='option' aria-selected='false'><span class='k-list-item-text'>${render(item)}</span></li>`
		),
		itemContent: template,
		toolbar: `<div role='toolbar' class='k-listbox-actions'></div>`
	};
};

This internal override is version-dependent. Test rendering, selection, toolbar actions, and item transfers in your installed version. It preserves existing custom templates, which must encode untrusted values separately. Do not also pre-encode the field when applying this override, because doing so can cause double encoding.

Notes

• If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
• We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.

External References

CVE-2026-106147 (Medium)

CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4)

In Progress® Kendo® UI for jQuery releases starting with R1 2020 and prior to 2026.3.1015, the ListBox default item template renders the bound dataTextField value as raw HTML without encoding. An attacker who can modify the bound data can supply HTML containing event handlers that execute JavaScript in a user's browser when the affected list item is rendered. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.

Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)