{"id":"CVE-2026-106144","kind":"vulnerability","aliases":["CVE-2026-106144"],"related":[],"title":"Kendo UI for Angular: Scheduler prototype pollution lets a privileged user alter built-in objects","description":"Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.","summary":"Kendo UI for Angular's Scheduler component (in @progress/kendo-angular-scheduler and @progress/kendo-angular-common) fails to block prototype pollution through field paths it processes. A high-privileged attacker who controls such a field path can modify the prototype of built-in JavaScript objects, with limited impact on confidentiality, integrity and availability.","severity":"medium","cvss":4.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["angular","frontend","kendo-ui","npm","package"],"not_affected_if":["field-paths-not-user-controlled","scheduler-not-used","version-25.1.0-or-later"],"how_to_check":"- Check the installed Kendo version in `package.json` or `package-lock.json` for `@progress/kendo-angular-scheduler` and `@progress/kendo-angular-common`\n- Run `npm ls @progress/kendo-angular-scheduler @progress/kendo-angular-common` to see the resolved versions","fix":"- Kendo UI for Angular: upgrade to `25.1.0` or later","status":"open","published_at":"2026-11-06T17:17:12+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","triaged_at":"2026-11-06T17:45:40+00:00","updated_at":"2026-11-06T17:45:40+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-06T17:45:40Z","model":"claude-haiku-5-5","output":{"fix":"- Kendo UI for Angular: upgrade to `25.1.0` or later","reach":"unknown","title":"Kendo UI for Angular: Scheduler prototype pollution lets a privileged user alter built-in objects","impact":"low","summary":"Kendo UI for Angular's Scheduler component (in @progress/kendo-angular-scheduler and @progress/kendo-angular-common) fails to block prototype pollution through field paths it processes. A high-privileged attacker who controls such a field path can modify the prototype of built-in JavaScript objects, with limited impact on confidentiality, integrity and availability.","audience":"developers","category":"package","nicknames":[],"who_cares":["angular","kendo-ui","npm","frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Built-in object prototypes modified, with limited confidentiality, integrity and availability impact","analyst_note":"","how_to_check":"- Check the installed Kendo version in `package.json` or `package-lock.json` for `@progress/kendo-angular-scheduler` and `@progress/kendo-angular-common`\n- Run `npm ls @progress/kendo-angular-scheduler @progress/kendo-angular-common` to see the resolved versions","plain_action":"","needs_analyst":false,"not_affected_if":["version-25.1.0-or-later","scheduler-not-used","field-paths-not-user-controlled"],"who_is_affected":"Applications that use the Kendo UI for Angular Scheduler and pass user-controllable field paths into it. Exploitation requires a high-privileged attacker, so applications where only trusted users can configure field paths face lower risk. Teams not using the Scheduler or not on versions before 25.1.0 can skip it.","user_interaction":"unknown","needs_special_setup":"yes","severity_if_unknown":"medium"},"cost_usd":0.000751,"input_tokens":4260,"output_tokens":651,"severity_before":"medium"},"analyst_status":null,"analyst_note":null,"search":"'-106144':19A,22A '-2026':18A,21A '25.1.0':99C 'allow':100C 'alter':12A 'angular':4A,23B,33B,95C 'attack':55B,105C 'avail':79B,134C 'block':43B 'built':14A,68B,122C 'built-in':13A,67B,121C 'compon':36B,85C 'confidenti':76B,131C 'control':57B,108C 'cve':17A,20A 'fail':41B 'field':47B,60B,110C 'frontend':24B 'high':53B,103C 'high-privileg':52B,102C 'impact':74B,129C 'integr':77B,132C 'javascript':70B 'kendo':1A,26B,30B,92C 'kendo-ui':25B 'let':8A 'limit':73B,128C 'modifi':63B,117C 'npm':28B 'object':16A,71B,124C 'packag':29B 'path':48B,61B,111C 'pollut':7A,45B,81C 'prior':97C 'privileg':10A,54B,104C 'process':50B,112C 'progress':90C 'progress/kendo-angular-common':40B,88C 'progress/kendo-angular-scheduler':38B,86C 'prototyp':6A,44B,65B,80C,119C 'result':125C 'schedul':5A,35B,84C,115C 'softwar':91C 'ui':2A,27B,31B,93C 'user':11A 'version':96C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Kendo UI for Angular Scheduler and pass user-controllable field paths into it. Exploitation requires a high-privileged attacker, so applications where only trusted users can configure field paths face lower risk. Teams not using the Scheduler or not on versions before 25.1.0 can skip it.","tier":"C","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["angular","frontend","kendoui","medium","npm","package"],"campaign_type":null,"search_a":"'-106144':19A,22A '-2026':18A,21A 'alter':12A 'angular':4A 'built':14A 'built-in':13A 'cve':17A,20A 'kendo':1A 'let':8A 'object':16A 'pollut':7A 'privileg':10A 'prototyp':6A 'schedul':5A 'ui':2A 'user':11A","search_b":"'angular':23B,33B 'attack':55B 'avail':79B 'block':43B 'built':68B 'built-in':67B 'compon':36B 'confidenti':76B 'control':57B 'fail':41B 'field':47B,60B 'frontend':24B 'high':53B 'high-privileg':52B 'impact':74B 'integr':77B 'javascript':70B 'kendo':26B,30B 'kendo-ui':25B 'limit':73B 'modifi':63B 'npm':28B 'object':71B 'packag':29B 'path':48B,61B 'pollut':45B 'privileg':54B 'process':50B 'progress/kendo-angular-common':40B 'progress/kendo-angular-scheduler':38B 'prototyp':44B,65B 'schedul':35B 'ui':27B,31B","search_c":"'25.1.0':99C 'allow':100C 'angular':95C 'attack':105C 'avail':134C 'built':122C 'built-in':121C 'compon':85C 'confidenti':131C 'control':108C 'field':110C 'high':103C 'high-privileg':102C 'impact':129C 'integr':132C 'kendo':92C 'limit':128C 'modifi':117C 'object':124C 'path':111C 'pollut':81C 'prior':97C 'privileg':104C 'process':112C 'progress':90C 'progress/kendo-angular-common':88C 'progress/kendo-angular-scheduler':86C 'prototyp':80C,119C 'result':125C 'schedul':84C,115C 'softwar':91C 'ui':93C 'version':96C","first_public_at":"2026-11-06T17:17:12+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-106144","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106144","severity":null,"published_at":"2026-11-06T17:17:12+00:00","modified_at":"2026-11-06T17:17:12+00:00","first_seen_at":"2026-11-06T17:43:12+00:00","fetched_at":"2026-11-06T17:43:12+00:00","note":null}],"documents":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}