CVE-2026-106144 · Package
NO FIX YET · SEE WHAT TO DO
Kendo UI for Angular's Scheduler component (in @progress/kendo-angular-scheduler and @progress/kendo-angular-common) fails to block prototype pollution through field paths it processes. A high-privileged attacker who controls such a field path can modify the prototype of built-in JavaScript objects, with limited impact on confidentiality, integrity and availability.
first public Nov 6, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Applications that use the Kendo UI for Angular Scheduler and pass user-controllable field paths into it. Exploitation requires a high-privileged attacker, so applications where only trusted users can configure field paths face lower risk. Teams not using the Scheduler or not on versions before 25.1.0 can skip it.
Not affected if field-paths-not-user-controlled, scheduler-not-used, version-25.1.0-or-later
Who cares angular, frontend, kendo-ui, npm
package.json or package-lock.json for @progress/kendo-angular-scheduler and @progress/kendo-angular-commonnpm ls @progress/kendo-angular-scheduler @progress/kendo-angular-common to see the resolved versions25.1.0 or laterPrototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.
This page as .md · .json · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.