---
id: "CVE-2026-124687"
page: "https://infrastack.ai/live/CVE-2026-124687"
kind: "vulnerability"
aliases: ["CVE-2026-124687"]
title: "Kendo UI for jQuery: markup injection in DropDownButton and SplitButton"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frontend", "javascript", "jquery", "kendo-ui", "package"]
not_affected_if: ["fixed-item-values", "no-dropdownbutton-or-splitbutton", "version-outside-range"]
published_at: "2026-11-11T17:17:17+00:00"
first_seen_at: "2026-11-11T17:28:21+00:00"
updated_at: "2026-11-11T17:28:52+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124687", "first_seen_at": "2026-11-11T17:28:21+00:00"}]
exploit_sources: []
---

# Kendo UI for jQuery: markup injection in DropDownButton and SplitButton

Link for people: https://infrastack.ai/live/CVE-2026-124687 (this .md is for agents)

Kendo UI for jQuery's DropDownButton and SplitButton components do not escape the id and target attribute values of their items. An attacker who can control those values can inject markup, including event handlers that run script in the user's browser.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Find the Kendo UI for jQuery version in your project's `package.json` or bower/vendor files, and check whether it is between `2022.2.621` and `2026.4.1111` (exclusive of the fixed version)
- Check whether any DropDownButton or SplitButton item `id` or `target` values come from user input or stored data

## Fix

- Kendo UI for jQuery: upgrade to `2026.4.1111`

## Timeline

- 2026-11-11T17:28:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124687

## From the sources

In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_