CVE-2026-124687 · Package
NO FIX YET · SEE WHAT TO DO
Kendo UI for jQuery's DropDownButton and SplitButton components do not escape the id and target attribute values of their items. An attacker who can control those values can inject markup, including event handlers that run script in the user's browser.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Kendo UI for jQuery's DropDownButton or SplitButton and build item id or target values from data an attacker can influence. Apps that use these components only with fixed, developer-written values are less exposed. The sources do not say which configurations are most exposed.
Not affected if fixed-item-values, no-dropdownbutton-or-splitbutton, version-outside-range
Who cares frontend, javascript, jquery, kendo-ui
package.json or bower/vendor files, and check whether it is between 2022.2.621 and 2026.4.1111 (exclusive of the fixed version)id or target values come from user input or stored data2026.4.1111In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.