---
id: "CVE-2026-124689"
page: "https://infrastack.ai/live/CVE-2026-124689"
kind: "vulnerability"
aliases: ["CVE-2026-124689"]
title: "Kendo UI for jQuery: ActionSheet lets injected markup run as script"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frontend", "javascript", "jquery", "kendo-ui", "package"]
not_affected_if: ["fixed-text-only", "no-actionsheet-usage"]
published_at: "2026-11-11T17:17:17+00:00"
first_seen_at: "2026-11-11T17:28:21+00:00"
updated_at: "2026-11-11T17:28:50+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124689", "first_seen_at": "2026-11-11T17:28:21+00:00"}]
exploit_sources: []
---

# Kendo UI for jQuery: ActionSheet lets injected markup run as script

Link for people: https://infrastack.ai/live/CVE-2026-124689 (this .md is for agents)

Kendo UI for jQuery's ActionSheet component does not encode its title, subtitle and header button label values before rendering them. An attacker who can control those values can inject markup that runs JavaScript in the browser of a user who opens the ActionSheet.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kendo UI for jQuery version in the project's `package.json` or lock file and see whether it falls in `2026.3.1014` up to but not including `2026.4.1110`.
- Search the codebase for ActionSheet usage that renders title, subtitle or header button label values from user-influenced data.

## Fix

- Kendo UI for jQuery: move to `2026.4.1110` or later.

## Timeline

- 2026-11-11T17:28:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124689

## From the sources

In Progress Kendo UI for jQuery versions 2026.3.1014 up to, but not including, 2026.4.1110, ActionSheet does not encode title, subtitle, and header button label values before rendering them. An attacker who can influence these values can inject markup that executes as JavaScript when a user opens the ActionSheet. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The report identifies version 2026.3.1014; the first affected release has not been established.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_