CVE-2026-124689 · Package
NO FIX YET · SEE WHAT TO DO
Kendo UI for jQuery's ActionSheet component does not encode its title, subtitle and header button label values before rendering them. An attacker who can control those values can inject markup that runs JavaScript in the browser of a user who opens the ActionSheet.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use the Kendo UI for jQuery ActionSheet component and put untrusted or user-influenced text into its title, subtitle or header button labels. The first affected release is not established; the report identifies 2026.3.1014. Teams not using ActionSheet, or only showing fixed text there, are unlikely to be exposed.
Not affected if fixed-text-only, no-actionsheet-usage
Who cares frontend, javascript, jquery, kendo-ui
package.json or lock file and see whether it falls in 2026.3.1014 up to but not including 2026.4.1110.2026.4.1110 or later.In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.