{"id":"CVE-2026-124689","kind":"vulnerability","aliases":["CVE-2026-124689"],"related":[],"title":"Kendo UI for jQuery: ActionSheet lets injected markup run as script","description":"In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established.","summary":"Kendo UI for jQuery's ActionSheet component does not encode its title, subtitle and header button label values before rendering them. An attacker who can control those values can inject markup that runs JavaScript in the browser of a user who opens the ActionSheet.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","jquery","kendo-ui","package"],"not_affected_if":["fixed-text-only","no-actionsheet-usage"],"how_to_check":"- Check the installed Kendo UI for jQuery version in the project's `package.json` or lock file and see whether it falls in `2026.3.1014` up to but not including `2026.4.1110`.\n- Search the codebase for ActionSheet usage that renders title, subtitle or header button label values from user-influenced data.","fix":"- Kendo UI for jQuery: move to `2026.4.1110` or later.","status":"open","published_at":"2026-11-11T17:17:17+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","triaged_at":"2026-11-11T17:28:50+00:00","updated_at":"2026-11-11T17:28:50+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T17:28:50Z","model":"claude-haiku-5-5","output":{"fix":"- Kendo UI for jQuery: move to `2026.4.1110` or later.","reach":"internet","title":"Kendo UI for jQuery: ActionSheet lets injected markup run as script","impact":"high","summary":"Kendo UI for jQuery's ActionSheet component does not encode its title, subtitle and header button label values before rendering them. An attacker who can control those values can inject markup that runs JavaScript in the browser of a user who opens the ActionSheet.","audience":"developers","category":"package","nicknames":[],"who_cares":["kendo-ui","jquery","frontend","javascript"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in users' browsers, reading or changing their session data","analyst_note":"Confirm the affected version range start and whether attacker-controlled input reaches ActionSheet in typical apps; check the vendor advisory for the fix.","how_to_check":"- Check the installed Kendo UI for jQuery version in the project's `package.json` or lock file and see whether it falls in `2026.3.1014` up to but not including `2026.4.1110`.\n- Search the codebase for ActionSheet usage that renders title, subtitle or header button label values from user-influenced data.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-actionsheet-usage","fixed-text-only"],"who_is_affected":"Applications that use the Kendo UI for jQuery ActionSheet component and put untrusted or user-influenced text into its title, subtitle or header button labels. The first affected release is not established; the report identifies `2026.3.1014`. Teams not using ActionSheet, or only showing fixed text there, are unlikely to be exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000787,"input_tokens":4630,"output_tokens":648,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124689':14A,17A '-2026':13A,16A '2026.3.1014':76C,138C '2026.4.1110':82C 'actionsheet':5A,30B,68B,83C,116C 'affect':141C 'attack':47B,98C 'avail':127C 'browser':61B,132C 'button':40B,91C 'compon':31B 'compromis':120C 'confidenti':122C 'context':133C 'control':50B 'cve':12A,15A 'data':126C 'encod':34B,86C 'establish':146C 'execut':108C 'exploit':118C 'first':140C 'frontend':18B 'header':39B,90C 'identifi':136C 'includ':81C 'influenc':101C 'inject':7A,54B,105C 'integr':124C 'javascript':19B,58B,110C 'jqueri':4A,20B,28B,74C 'kendo':1A,22B,25B,71C 'kendo-ui':21B 'label':41B,92C 'let':6A 'markup':8A,55B,106C 'may':119C 'open':66B,114C 'packag':24B 'progress':70C 'releas':142C 'render':44B,95C 'report':135C 'run':9A,57B 'script':11A 'subtitl':37B,88C 'success':117C 'titl':36B,87C 'ui':2A,23B,26B,72C 'user':64B,113C,130C 'valu':42B,52B,93C,103C 'version':75C,137C","nicknames":[],"mitigations":[],"who_affected":"Applications that use the Kendo UI for jQuery ActionSheet component and put untrusted or user-influenced text into its title, subtitle or header button labels. The first affected release is not established; the report identifies `2026.3.1014`. Teams not using ActionSheet, or only showing fixed text there, are unlikely to be exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frontend","high","javascript","jquery","kendoui","package"],"campaign_type":null,"search_a":"'-124689':14A,17A '-2026':13A,16A 'actionsheet':5A 'cve':12A,15A 'inject':7A 'jqueri':4A 'kendo':1A 'let':6A 'markup':8A 'run':9A 'script':11A 'ui':2A","search_b":"'actionsheet':30B,68B 'attack':47B 'browser':61B 'button':40B 'compon':31B 'control':50B 'encod':34B 'frontend':18B 'header':39B 'inject':54B 'javascript':19B,58B 'jqueri':20B,28B 'kendo':22B,25B 'kendo-ui':21B 'label':41B 'markup':55B 'open':66B 'packag':24B 'render':44B 'run':57B 'subtitl':37B 'titl':36B 'ui':23B,26B 'user':64B 'valu':42B,52B","search_c":"'2026.3.1014':76C,138C '2026.4.1110':82C 'actionsheet':83C,116C 'affect':141C 'attack':98C 'avail':127C 'browser':132C 'button':91C 'compromis':120C 'confidenti':122C 'context':133C 'data':126C 'encod':86C 'establish':146C 'execut':108C 'exploit':118C 'first':140C 'header':90C 'identifi':136C 'includ':81C 'influenc':101C 'inject':105C 'integr':124C 'javascript':110C 'jqueri':74C 'kendo':71C 'label':92C 'markup':106C 'may':119C 'open':114C 'progress':70C 'releas':142C 'render':95C 'report':135C 'subtitl':88C 'success':117C 'titl':87C 'ui':72C 'user':113C,130C 'valu':93C,103C 'version':75C,137C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:17+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124689","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124689","severity":null,"published_at":"2026-11-11T17:17:17+00:00","modified_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","fetched_at":"2026-11-11T17:28:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}