Kendo UI for jQuery: Cross-site scripting in ActionSheet header labels
Summary
Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110 do not encode the title, subtitle and header button label values of the ActionSheet component before rendering them. An attacker who can influence these values can inject markup that runs as JavaScript when a user opens the ActionSheet. The script runs in the victim's browser context and can compromise the confidentiality and integrity of data available there.
Affected
- Kendo UI for jQuery 2026.3.1014 up to, but not including, 2026.4.1110
- The first affected release has not been established; 2026.3.1014 is the version identified in the report.
Fixed in
- Upgrade to Kendo UI for jQuery 2026.4.1110 or later. Version 2026.4.1111 or later also covers the related CVE-2026-124688.
Workaround
- No other mitigation or workaround is indicated by the vendor advisory (unverified against the vendor page).
- Encode or sanitise untrusted title, subtitle and button label values before they reach the ActionSheet.
- A Content Security Policy can limit the impact of injected script, but it is not a verified fix for this issue.
Exploitation
- Exploited in the wild: not known.
- Public proof-of-concept: none known.
- Requires user interaction: a user must open the ActionSheet. No privileges or authentication are required.
Our recommendation
- Check whether SME-built web applications or vendor products bundle Kendo UI for jQuery, and identify the version in use.
- Upgrade to 2026.4.1111 or later.
- Until patched, make sure ActionSheet titles, subtitles and button labels do not contain untrusted data.
- Verify the version against the vendor advisory, as the npm package label of 2026.3.1015 falls within the affected range.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik security advisory CVE-2026-124689 www.telerik.com
- OffSeq Radar: CVE-2026-124689 radar.offseq.com
- OffSeq Radar: CVE-2026-124688 (fixed in 2026.4.1111) radar.offseq.com
- VulDB entry 435862 vuldb.com
- Snyk package page @progress/kendo-ui security.snyk.io
- Telerik security information www.telerik.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:25.
Original description (NVD)
In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.