Kendo UI for jQuery: Cross-site scripting in DropDownButton and SplitButton items
Summary
Kendo UI for jQuery versions from 2022.2.621 before 2026.4.1111 allow markup injection through the id and target attributes of DropDownButton and SplitButton items. An attacker who can influence these item values can break out of the attributes and inject HTML, including event handlers, which run as script in the victim's browser. Exploitation requires user interaction, and the realistic path is a web application that builds these menus from untrusted data.
Affected
- Kendo UI for jQuery from 2022.2.621 up to, but not including, 2026.4.1111
- Components: DropDownButton and SplitButton
- Default configuration: unaffected (per CNA record)
Fixed in
- Upgrade to Kendo UI for jQuery 2026.4.1111 or later
- Backport status for older branches: Unknown.
Workaround
- No vendor workaround found in accessible sources. Check the vendor advisory for mitigation guidance.
- Until upgraded, ensure item labels, ids and targets are never built from untrusted input.
Exploitation
- No evidence of exploitation in the wild found. Not known to be exploited per OffSeq; no CISA KEV entry found in searches (not conclusive).
- VulDB states no exploit is available, though technical details are known. No public proof of concept found.
Our recommendation
- Check whether any internet-facing or internal web application uses Kendo UI for jQuery in the affected range, including vendor-built products.
- Patch to 2026.4.1111 or later; ask third-party vendors for their update timeline where the library is embedded.
- Until patched, ensure menu item values are not derived from user-controlled input.
- Prioritise internet-facing applications handling sensitive sessions and admin interfaces.
- Note: CVSS 7.1 is from the CNA; VulDB rates it 4.3 and uses CWE-79. Verify the vendor KB for exact fix notes.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE record reference: Telerik KB on DropDownButton and SplitButton XSS www.telerik.com
- CVE-2026-124687 details (threatint) cve.threatint.com
- VulDB entry 435855 vuldb.com
- OffSeq radar: CVE-2026-124687 radar.offseq.com
- Kendo UI for jQuery SplitButton API reference www.telerik.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:24.
Original description (NVD)
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.