Kendo UI for jQuery PropertyGrid: Cross-site scripting in values and descriptions
Summary
Kendo UI for jQuery versions 2026.3.1015 up to 2026.4.1110 do not encode bound property values and items[].description in PropertyGrid in its default configuration. An attacker who can influence these values can run JavaScript in the browser of a user who views the grid, which may expose or change data in that browser context. Exploitation requires that the user interacts with the affected page, for example by opening it, and that the attacker can influence the displayed data.
Affected
- Kendo UI for jQuery 2026.3.1015 up to, but not including, 2026.4.1110
- First affected release: Unknown.
Fixed in
- Upgrade to Kendo UI for jQuery 2026.4.1110 or later.
- Vendor release notes must be checked to confirm whether 2026.4.1111 is the required or preferred build (conflicting third-party data).
Workaround
- No vendor workaround found.
- Until patched: do not bind PropertyGrid items or descriptions to untrusted or user-editable data, encode or sanitise these values server-side, and consider a Content Security Policy to limit the impact of injected scripts.
Exploitation
- No evidence of exploitation in the wild found.
- No public proof of concept found; this does not rule one out.
- NVD status: Awaiting Analysis.
Our recommendation
- Identify applications that use Kendo UI for jQuery and their versions.
- Upgrade affected versions to the newest available build, at least 2026.4.1110, and check whether 2026.4.1111 is required.
- Review whether PropertyGrid displays untrusted data and apply server-side encoding until patched.
- Check the vendor advisory and NVD for updates, including the first affected version.
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Telerik security advisory CVE-2026-124694 www.telerik.com
- OffSeq Radar: CVE-2026-124694 radar.offseq.com
- VulDB 435855 (version conflict) vuldb.com
- VulDB 435862 (version conflict) vuldb.com
- Telerik jQuery support www.telerik.com
- Telerik PropertyGrid get started www.telerik.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 18:24.
Original description (NVD)
In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.