{"id":"CVE-2026-124687","kind":"vulnerability","aliases":["CVE-2026-124687"],"related":[],"title":"Kendo UI for jQuery: markup injection in DropDownButton and SplitButton","description":"In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.","summary":"Kendo UI for jQuery's DropDownButton and SplitButton components do not escape the id and target attribute values of their items. An attacker who can control those values can inject markup, including event handlers that run script in the user's browser.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","jquery","kendo-ui","package"],"not_affected_if":["fixed-item-values","no-dropdownbutton-or-splitbutton","version-outside-range"],"how_to_check":"- Find the Kendo UI for jQuery version in your project's `package.json` or bower/vendor files, and check whether it is between `2022.2.621` and `2026.4.1111` (exclusive of the fixed version)\n- Check whether any DropDownButton or SplitButton item `id` or `target` values come from user input or stored data","fix":"- Kendo UI for jQuery: upgrade to `2026.4.1111`","status":"open","published_at":"2026-11-11T17:17:17+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","triaged_at":"2026-11-11T17:28:52+00:00","updated_at":"2026-11-11T17:28:52+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T17:28:52Z","model":"claude-haiku-5-5","output":{"fix":"- Kendo UI for jQuery: upgrade to `2026.4.1111`","reach":"unknown","title":"Kendo UI for jQuery: markup injection in DropDownButton and SplitButton","impact":"medium","summary":"Kendo UI for jQuery's DropDownButton and SplitButton components do not escape the id and target attribute values of their items. An attacker who can control those values can inject markup, including event handlers that run script in the user's browser.","audience":"developers","category":"package","nicknames":[],"who_cares":["kendo-ui","jquery","javascript","frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in users' browsers through injected event handlers","analyst_note":"Ecosystem and the exact auth or user interaction requirements are not stated by the sources.\n","how_to_check":"- Find the Kendo UI for jQuery version in your project's `package.json` or bower/vendor files, and check whether it is between `2022.2.621` and `2026.4.1111` (exclusive of the fixed version)\n- Check whether any DropDownButton or SplitButton item `id` or `target` values come from user input or stored data","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["fixed-item-values","no-dropdownbutton-or-splitbutton","version-outside-range"],"who_is_affected":"Applications that use Kendo UI for jQuery's DropDownButton or SplitButton and build item id or target values from data an attacker can influence. Apps that use these components only with fixed, developer-written values are less exposed. The sources do not say which configurations are most exposed.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000761,"input_tokens":4589,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124687':13A,16A '-2026':12A,15A '2022.2.621':74C '2026.4.1111':77C,116C 'allow':82C 'attack':46B,92C 'attribut':40B,90C,104C 'break':100C 'browser':65B 'compon':32B 'control':49B 'cve':11A,14A 'dropdownbutton':8A,29B,79C 'escap':35B 'event':56B,109C 'fix':114C 'frontend':17B 'handler':57B,110C 'id':37B,87C 'includ':55B,108C 'influenc':95C 'inject':6A,53B,84C,106C 'issu':112C 'item':44B,97C 'javascript':18B 'jqueri':4A,19B,27B,71C 'kendo':1A,21B,24B,68C 'kendo-ui':20B 'markup':5A,54B,83C,107C 'packag':23B 'prior':75C 'progress':67C 'run':59B 'script':60B 'splitbutton':10A,31B,81C 'target':39B,89C 'ui':2A,22B,25B,69C 'user':63B 'valu':41B,51B,98C 'version':72C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Kendo UI for jQuery's DropDownButton or SplitButton and build item id or target values from data an attacker can influence. Apps that use these components only with fixed, developer-written values are less exposed. The sources do not say which configurations are most exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frontend","high","javascript","jquery","kendoui","package"],"campaign_type":null,"search_a":"'-124687':13A,16A '-2026':12A,15A 'cve':11A,14A 'dropdownbutton':8A 'inject':6A 'jqueri':4A 'kendo':1A 'markup':5A 'splitbutton':10A 'ui':2A","search_b":"'attack':46B 'attribut':40B 'browser':65B 'compon':32B 'control':49B 'dropdownbutton':29B 'escap':35B 'event':56B 'frontend':17B 'handler':57B 'id':37B 'includ':55B 'inject':53B 'item':44B 'javascript':18B 'jqueri':19B,27B 'kendo':21B,24B 'kendo-ui':20B 'markup':54B 'packag':23B 'run':59B 'script':60B 'splitbutton':31B 'target':39B 'ui':22B,25B 'user':63B 'valu':41B,51B","search_c":"'2022.2.621':74C '2026.4.1111':77C,116C 'allow':82C 'attack':92C 'attribut':90C,104C 'break':100C 'dropdownbutton':79C 'event':109C 'fix':114C 'handler':110C 'id':87C 'includ':108C 'influenc':95C 'inject':84C,106C 'issu':112C 'item':97C 'jqueri':71C 'kendo':68C 'markup':83C,107C 'prior':75C 'progress':67C 'splitbutton':81C 'target':89C 'ui':69C 'valu':98C 'version':72C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124687","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124687","severity":null,"published_at":"2026-11-11T17:17:17+00:00","modified_at":"2026-11-11T17:17:17+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","fetched_at":"2026-11-11T17:28:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}