CVE-2026-119102 · Package
NO FIX YET
In Telerik UI for Blazor versions 12.0.0 through 15.2.0, the Grid, TreeList and Gantt AI command filters accept any model property, ignoring the declared column allowlist. An attacker who can drive those AI filter commands can query data fields the developer meant to hide.
first public Nov 13, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications built with Telerik UI for Blazor versions 12.0.0 through 15.2.0 that use the Grid, TreeList or Gantt AI command filters. The sources do not say whether the AI filter feature is on by default, so teams should confirm whether they enabled it. Teams not using these components or the AI filters can skip it.
Not affected if ai-filters-disabled, other-ui-library
Who cares blazor, dotnet, telerik-ui
dotnet list packageNo fix yet, per the sources.
In Telerik UI for Blazor, versions v12.0.0 through 15.2.0, an improper input validation vulnerability exists, where the Grid, TreeList and Gantt's AI command filters on any model property, bypassing the declared column allowlist.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.