Cross-Site Scripting in Validator Validation Messages in Kendo UI for jQuery (CVE-2026-106151)
Description
October 2026 - CVE-2026-106151
- Progress® Kendo® UI for jQuery 2026 Q3 (2026.3.811) or earlier.
What Are the Impacts
The Validator decodes validation messages from data-[rule]-msg attributes, such as data-required-msg, and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when a user triggers validation. JavaScript can execute in the user's browser and compromise the confidentiality and integrity of data accessible to the affected application. Escaping a message in the original page attribute alone does not prevent this vulnerability.
Is My Application Vulnerable?
Your application may be vulnerable if it uses an affected version and includes attacker-controlled content in data-[rule]-msg validation messages rendered by the Validator. Escaping these values in the original page attributes alone does not prevent the vulnerable decoding and rendering behavior.
Issue
- CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
- CAPEC-18: XSS Targeting Non-Script Elements
Solution
We have addressed the issue and the Progress Telerik team strongly recommends performing an upgrade to the latest version listed in the table below.
| Current Version | Update to |
|---|---|
>= 2012.2.710 && < 2026.3.811 | >= 2026.3.1015 |
Follow the update instructions for precise instructions. All customers who have a license for Progress® Kendo® UI for jQuery can access their downloads here Product Downloads | Your Account.
Notes
- If you have any questions or concerns related to this issue, open a new Technical Support case in Your Account | Support Center. Technical Support is available to customers with an active support plan.
- We would like to thank Abhishek Nandkumar Bhaskar (Abhi-Hackz) for their responsible disclosure and cooperation.
External References
CVE-2026-106151 (Medium)
CVSS: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N (5.4)
In Progress® Kendo® UI for jQuery versions starting with 2012.2.710 and prior to 2026.3.811, the Validator decodes validation messages from data-[rule]-msg attributes and parses the resulting text as HTML. An attacker who can modify a validation message can cause HTML that was correctly escaped in the page attribute to become active markup, including event handlers, when the user triggers validation. Successful exploitation can execute JavaScript in a user's browser and compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.
Finder Credit: Abhishek Nandkumar Bhaskar (Abhi-Hackz)