CVE-2026-106148

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-106148

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106148.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-106148

Published

2026-10-15T13:28:22Z

Modified

2026-10-28T02:30:27Z

Severity

5.4 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Cross-Site Scripting via TabStrip, Menu, and PanelBar Image URLs in Kendo UI for jQuery

Details

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, the TabStrip, Menu, and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected component renders the image. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

Database specific

{
    "cna_assigner":  "ProgressSoftware",
    "cwe_ids":  [
        "CWE-80"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106148.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "range":  [
                        {
                            "introduced":  "2011.2.804"
                        },
                        {
                            "fixed":  "2026.3.1015"
                        }
                    ],
                    "source":  "AFFECTED_FIELD",
                    "strategy":  "StandardRange"
                }
            ]
        }
    ]
}

References

Affected packages

Git / github.com/telerik/kendo-ui-core

Affected ranges

Type

GIT

Repo

https://github.com/telerik/kendo-ui-core

Events

Introduced

57e7fd57fc1c828414120019c81e730979ace47d

Fixed

c324e79576cc977b9f40e8a56f8ab1ccae4a10cf

Database specific

Show details

{
    "extracted_events":  [
        {
            "cpe":  "cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*",
            "range":  [
                {
                    "introduced":  "2011.2.804"
                },
                {
                    "fixed":  "2026.3.1015"
                }
            ],
            "source":  "CPE_RANGE"
        }
    ]
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106148.json"