CVE-2026-124690 · Package
NO FIX YET · SEE WHAT TO DO
Kendo UI for jQuery's sanitizeSvgContent() parses custom icon markup into a live DOM before removing unsafe elements. An attacker who can influence custom icon content can get JavaScript to run in the page during icon creation.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Kendo UI for jQuery and let users or outside data supply custom icon SVG markup are exposed, since the flaw runs during icon creation. Apps that only use built-in icons, or never accept outside icon content, are less exposed. The first affected release is not established, so teams should check any version up to and including the reported 2026.3.1015.
Not affected if built-in-icons-only, no-user-supplied-svg
Who cares frontend, javascript, jquery, kendo-ui
package.json or package-lock.json, for example with npm ls @progress/kendo-ui2026.3.10152026.4.1110In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.