Kendo UI for jQuery: Cross-site scripting via spriteCssClass in TabStrip, PanelBar and Menu
Summary
Kendo UI for jQuery versions before 2026.4.1111 contain a cross-site scripting flaw in the TabStrip, PanelBar and Menu widgets when a dataSource field is mapped to spriteCssClass. If an attacker can control the mapped data, they can inject markup including event-handler attributes. The script runs in the application's origin when a victim loads a page that renders the affected widget, so it can access data and actions available in the victim's authenticated session.
Affected
- Progress Software Kendo UI for jQuery 2012.1.322 (lower bound not confirmed) up to 2026.4.1110
- Only applications that map a dataSource field to spriteCssClass in these widgets are affected
- Related item CVE-2026-124687 is addressed by the same fixed version
Fixed in
- Upgrade to Kendo UI for jQuery 2026.4.1111 or later
- Backports to older release branches: Unknown.
Workaround
- Unknown. No vendor workaround found.
- Interim measures suggested by the research (not confirmed by the vendor): make sure no user-supplied text reaches the sprite class field, encode data server-side, and use a Content Security Policy that restricts inline event handlers. Verify effectiveness with the developers before relying on them.
Exploitation
- No confirmed in-the-wild exploitation known.
- OffSeq lists the vulnerability as not known to be exploited.
- VulDB states that no exploit exists and assesses exploitation as easy.
- No public proof of concept found.
- CISA KEV status: Unknown (not checked).
Our recommendation
- Inventory all applications that use Kendo UI for jQuery and record the jQuery build version.
- Upgrade to 2026.4.1111 or later, starting with internet-facing applications that render user-influenced menu, tab or panel data.
- Check whether any mapped data can be influenced by users and remove that path until the upgrade is done.
- Check the Telerik advisory to confirm the version details, as it could not be retrieved during research.
- Monitor web application logs for unusual requests.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik knowledge base advisory (not retrieved) www.telerik.com
- VulDB entry CVE-2026-124688 vuldb.com
- OffSeq radar CVE-2026-124688 radar.offseq.com
- threatint CVE-2026-124688 cve.threatint.com
- Telerik DropDownButton spriteCssClass documentation www.telerik.com
- Telerik TabStrip API documentation www.telerik.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:25.
Original description (NVD)
In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.