Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery (CVE-2026-106160)
Description
October 2026 - CVE-2026-106160
- Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.
What Are the Impacts
Model.accept() passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior. This can compromise the confidentiality and integrity of application data, depending on how the application uses the modified objects, including in server-side JavaScript scenarios.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and accepts attacker-controlled model data through Model.accept() or passes untrusted property paths to kendo.setter.
Issue
- CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 2023.1.117 && <= 2026.3.811 | >= 2026.3.1015 |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- The first affected version has not been confirmed.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVE-2026-106160 (Medium)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4)
In Progress® Kendo® UI for jQuery prior to 2026.3.811, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing proto, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)