{"id":"CVE-2026-106127","kind":"vulnerability","aliases":["CVE-2026-106127"],"related":[],"title":"KendoReact setter utility: prototype pollution via controlled field paths","description":"Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.","summary":"The setter utility in @progress/kendo-react-common, used by KendoReact versions 3.5.0 through 16.0.0, lets a high-privileged user who controls a field path modify built-in object prototypes. The sources describe the impact as limited to confidentiality, integrity and availability.","severity":"medium","cvss":4.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","kendo-react","npm","package"],"not_affected_if":["default-config"],"how_to_check":"- Check the installed version of `@progress/kendo-react-common` in your lockfile or with `npm ls @progress/kendo-react-common`\n- Confirm whether your app uses KendoReact Form, Scheduler or Gantt with user-controlled field paths","fix":null,"status":"open","published_at":"2026-11-06T17:17:11+00:00","first_seen_at":"2026-11-06T17:43:11+00:00","triaged_at":"2026-11-06T17:45:41+00:00","updated_at":"2026-11-06T17:45:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T17:45:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"KendoReact setter utility: prototype pollution via controlled field paths","impact":"low","summary":"The setter utility in @progress/kendo-react-common, used by KendoReact versions 3.5.0 through 16.0.0, lets a high-privileged user who controls a field path modify built-in object prototypes. The sources describe the impact as limited to confidentiality, integrity and availability.","audience":"developers","category":"package","nicknames":[],"who_cares":["kendo-react","javascript","npm"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"modifies built-in object prototypes with limited confidentiality and integrity impact","analyst_note":"Find the fixed version of @progress/kendo-react-common from Progress's KendoReact advisory; the sources give only the affected range 3.5.0 through 16.0.0.","how_to_check":"- Check the installed version of `@progress/kendo-react-common` in your lockfile or with `npm ls @progress/kendo-react-common`\n- Confirm whether your app uses KendoReact Form, Scheduler or Gantt with user-controlled field paths","plain_action":"","needs_analyst":true,"not_affected_if":["default-config"],"who_is_affected":"Applications that use KendoReact in the affected version range and pass user-controlled field paths to the setter utility, directly or through the Form, Scheduler or Gantt components. The attacker needs high privileges. Apps that do not let users control those field paths are less exposed; the sources do not say more.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000717,"input_tokens":4269,"output_tokens":581,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106127':12A,15A '-2026':11A,14A '16.0.0':33B,77C '3.5.0':31B,75C 'allow':78C 'attack':83C 'avail':62B,123C 'built':47B,111C 'built-in':46B,110C 'compon':97C 'confidenti':59B,120C 'control':7A,41B,86C 'cve':10A,13A 'describ':53B 'direct':94C 'field':8A,43B,88C 'form':101C 'gantt':104C 'high':37B,81C 'high-privileg':36B,80C 'impact':55B,118C 'integr':60B,121C 'javascript':16B 'kendo':18B 'kendo-react':17B 'kendoreact':1A,29B,73C 'let':34B 'limit':57B,117C 'modifi':45B,106C 'npm':20B 'object':49B,113C 'packag':21B 'pass':90C 'path':9A,44B,89C 'pollut':5A,64C 'privileg':38B,82C 'progress':71C 'progress/kendo-react-common':26B,69C 'prototyp':4A,50B,63C,108C 'react':19B 'result':114C 'schedul':102C 'setter':2A,23B,67C 'softwar':72C 'sourc':52B 'use':27B 'user':39B 'util':3A,24B,68C,93C 'version':30B,74C 'via':6A","nicknames":[],"mitigations":[],"who_affected":"Applications that use KendoReact in the affected version range and pass user-controlled field paths to the setter utility, directly or through the Form, Scheduler or Gantt components. The attacker needs high privileges. Apps that do not let users control those field paths are less exposed; the sources do not say more.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["javascript","kendoreact","medium","npm","package"],"campaign_type":null,"search_a":"'-106127':12A,15A '-2026':11A,14A 'control':7A 'cve':10A,13A 'field':8A 'kendoreact':1A 'path':9A 'pollut':5A 'prototyp':4A 'setter':2A 'util':3A 'via':6A","search_b":"'16.0.0':33B '3.5.0':31B 'avail':62B 'built':47B 'built-in':46B 'confidenti':59B 'control':41B 'describ':53B 'field':43B 'high':37B 'high-privileg':36B 'impact':55B 'integr':60B 'javascript':16B 'kendo':18B 'kendo-react':17B 'kendoreact':29B 'let':34B 'limit':57B 'modifi':45B 'npm':20B 'object':49B 'packag':21B 'path':44B 'privileg':38B 'progress/kendo-react-common':26B 'prototyp':50B 'react':19B 'setter':23B 'sourc':52B 'use':27B 'user':39B 'util':24B 'version':30B","search_c":"'16.0.0':77C '3.5.0':75C 'allow':78C 'attack':83C 'avail':123C 'built':111C 'built-in':110C 'compon':97C 'confidenti':120C 'control':86C 'direct':94C 'field':88C 'form':101C 'gantt':104C 'high':81C 'high-privileg':80C 'impact':118C 'integr':121C 'kendoreact':73C 'limit':117C 'modifi':106C 'object':113C 'pass':90C 'path':89C 'pollut':64C 'privileg':82C 'progress':71C 'progress/kendo-react-common':69C 'prototyp':63C,108C 'result':114C 'schedul':102C 'setter':67C 'softwar':72C 'util':68C,93C 'version':74C","first_public_at":"2026-11-06T17:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106127","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106127","severity":null,"published_at":"2026-11-06T17:17:11+00:00","modified_at":"2026-11-06T17:17:11+00:00","first_seen_at":"2026-11-06T17:43:11+00:00","fetched_at":"2026-11-06T17:43:11+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}