{"id":"CVE-2026-106128","kind":"vulnerability","aliases":["CVE-2026-106128"],"related":[],"title":"Kendo UI for Vue: prototype pollution via field paths in common utilities","description":"Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.","summary":"Kendo UI for Vue's shared @progress/kendo-vue-common package lets a high-privileged user who controls a field path, such as one used by the Scheduler, modify built-in object prototypes. The sources describe a limited impact on confidentiality, integrity and availability.","severity":"medium","cvss":4.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["javascript","kendo-ui","package","vue"],"not_affected_if":["no-user-controlled-field-paths","package-not-installed"],"how_to_check":"- Check whether `@progress/kendo-vue-common` is in your dependencies, for example with `npm ls @progress/kendo-vue-common`\n- Check the installed version against the affected range, 0.4.0 through 9.2.0\n- Check whether user-controlled field paths reach Scheduler or similar components","fix":null,"status":"open","published_at":"2026-11-06T17:17:11+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","triaged_at":"2026-11-06T17:45:41+00:00","updated_at":"2026-11-06T17:45:41+00:00","category":"package","confidence":0.6,"triage":{"at":"2026-11-06T17:45:41Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Kendo UI for Vue: prototype pollution via field paths in common utilities","impact":"low","summary":"Kendo UI for Vue's shared @progress/kendo-vue-common package lets a high-privileged user who controls a field path, such as one used by the Scheduler, modify built-in object prototypes. The sources describe a limited impact on confidentiality, integrity and availability.","audience":"developers","category":"package","nicknames":[],"who_cares":["kendo-ui","vue","javascript"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Built-in object prototypes are modified, with limited confidentiality and integrity impact","analyst_note":"Find the vendor advisory from Progress to confirm the fixed version and whether the Scheduler path is the only trigger.","how_to_check":"- Check whether `@progress/kendo-vue-common` is in your dependencies, for example with `npm ls @progress/kendo-vue-common`\n- Check the installed version against the affected range, 0.4.0 through 9.2.0\n- Check whether user-controlled field paths reach Scheduler or similar components","plain_action":"","needs_analyst":true,"not_affected_if":["package-not-installed","no-user-controlled-field-paths"],"who_is_affected":"Applications that use Kendo UI for Vue versions 0.4.0 through 9.2.0 and pass field paths that can be influenced by a user with high privileges. The sources do not name a fixed version, so teams should confirm the vendor's patched release before deciding. Applications that do not use this package or do not expose such field paths can skip it.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000733,"input_tokens":4263,"output_tokens":614,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106128':15A,18A '-2026':14A,17A '0.4.0':80C '9.2.0':82C 'allow':83C 'attack':88C 'avail':67B,120C 'built':53B,108C 'built-in':52B,107C 'common':11A 'compon':97C 'confidenti':64B,117C 'control':40B,91C 'cve':13A,16A 'describ':59B 'field':8A,42B,93C 'high':36B,86C 'high-privileg':35B,85C 'impact':62B,115C 'integr':65B,118C 'javascript':19B 'kendo':1A,21B,25B,75C 'kendo-ui':20B 'let':33B 'limit':61B,114C 'modifi':51B,103C 'object':55B,110C 'one':46B 'packag':23B,32B 'path':9A,43B,94C 'pollut':6A,69C 'privileg':37B,87C 'process':95C 'progress':73C 'progress/kendo-vue-common':31B,71C 'prototyp':5A,56B,68C,105C 'result':111C 'schedul':50B,101C 'share':30B 'softwar':74C 'sourc':58B 'ui':2A,22B,26B,76C 'use':47B 'user':38B 'util':12A 'version':79C 'via':7A 'vue':4A,24B,28B,78C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Kendo UI for Vue versions 0.4.0 through 9.2.0 and pass field paths that can be influenced by a user with high privileges. The sources do not name a fixed version, so teams should confirm the vendor's patched release before deciding. Applications that do not use this package or do not expose such field paths can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["javascript","kendoui","medium","package","vue"],"campaign_type":null,"search_a":"'-106128':15A,18A '-2026':14A,17A 'common':11A 'cve':13A,16A 'field':8A 'kendo':1A 'path':9A 'pollut':6A 'prototyp':5A 'ui':2A 'util':12A 'via':7A 'vue':4A","search_b":"'avail':67B 'built':53B 'built-in':52B 'confidenti':64B 'control':40B 'describ':59B 'field':42B 'high':36B 'high-privileg':35B 'impact':62B 'integr':65B 'javascript':19B 'kendo':21B,25B 'kendo-ui':20B 'let':33B 'limit':61B 'modifi':51B 'object':55B 'one':46B 'packag':23B,32B 'path':43B 'privileg':37B 'progress/kendo-vue-common':31B 'prototyp':56B 'schedul':50B 'share':30B 'sourc':58B 'ui':22B,26B 'use':47B 'user':38B 'vue':24B,28B","search_c":"'0.4.0':80C '9.2.0':82C 'allow':83C 'attack':88C 'avail':120C 'built':108C 'built-in':107C 'compon':97C 'confidenti':117C 'control':91C 'field':93C 'high':86C 'high-privileg':85C 'impact':115C 'integr':118C 'kendo':75C 'limit':114C 'modifi':103C 'object':110C 'path':94C 'pollut':69C 'privileg':87C 'process':95C 'progress':73C 'progress/kendo-vue-common':71C 'prototyp':68C,105C 'result':111C 'schedul':101C 'softwar':74C 'ui':76C 'version':79C 'vue':78C","first_public_at":"2026-11-06T17:17:11+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106128","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106128","severity":null,"published_at":"2026-11-06T17:17:11+00:00","modified_at":"2026-11-06T17:17:11+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","fetched_at":"2026-11-06T17:43:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}