{"id":"CVE-2026-124690","kind":"vulnerability","aliases":["CVE-2026-124690"],"related":[],"title":"Kendo UI for jQuery: SVG icon sanitizer runs scripts before filtering","description":"In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.","summary":"Kendo UI for jQuery's sanitizeSvgContent() parses custom icon markup into a live DOM before removing unsafe elements. An attacker who can influence custom icon content can get JavaScript to run in the page during icon creation.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","jquery","kendo-ui","package"],"not_affected_if":["built-in-icons-only","no-user-supplied-svg"],"how_to_check":"- Check the installed Kendo UI for jQuery version in `package.json` or `package-lock.json`, for example with `npm ls @progress/kendo-ui`\n- Look for code paths that pass user-supplied or externally sourced SVG into Kendo custom icons\n- The first affected release is unknown; the reported version is `2026.3.1015`","fix":"- Kendo UI for jQuery: move to `2026.4.1110`","status":"open","published_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","triaged_at":"2026-11-11T17:28:45+00:00","updated_at":"2026-11-11T17:28:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T17:28:45Z","model":"claude-haiku-5-5","output":{"fix":"- Kendo UI for jQuery: move to `2026.4.1110`","reach":"unknown","title":"Kendo UI for jQuery: SVG icon sanitizer runs scripts before filtering","impact":"high","summary":"Kendo UI for jQuery's sanitizeSvgContent() parses custom icon markup into a live DOM before removing unsafe elements. An attacker who can influence custom icon content can get JavaScript to run in the page during icon creation.","audience":"developers","category":"package","nicknames":[],"who_cares":["kendo-ui","jquery","javascript","frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"Attacker script runs in the victim's browser session during icon creation","analyst_note":"","how_to_check":"- Check the installed Kendo UI for jQuery version in `package.json` or `package-lock.json`, for example with `npm ls @progress/kendo-ui`\n- Look for code paths that pass user-supplied or externally sourced SVG into Kendo custom icons\n- The first affected release is unknown; the reported version is `2026.3.1015`","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["built-in-icons-only","no-user-supplied-svg"],"who_is_affected":"Applications that use Kendo UI for jQuery and let users or outside data supply custom icon SVG markup are exposed, since the flaw runs during icon creation. Apps that only use built-in icons, or never accept outside icon content, are less exposed. The first affected release is not established, so teams should check any version up to and including the reported `2026.3.1015`.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"unknown"},"cost_usd":0.000762,"input_tokens":4594,"output_tokens":605,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124690':14A,17A '-2026':13A,16A '2026.3.1015':108C '2026.4.1110':123C 'affect':111C 'attack':44B,81C 'caus':89C 'content':50B,87C 'creation':61B,95C 'custom':32B,48B,70C,85C 'cve':12A,15A 'dom':38B,76C 'element':42B,99C 'establish':116C 'execut':92C 'filter':11A,78C 'first':110C 'fix':120C 'frontend':18B 'get':52B 'icon':6A,33B,49B,60B,71C,86C,94C 'influenc':47B,84C 'issu':103C,118C 'javascript':19B,53B,90C 'jqueri':4A,20B,28B,67C 'kendo':1A,22B,25B,64C 'kendo-ui':21B 'live':37B,75C 'markup':34B,72C 'packag':24B 'page':58B 'pars':31B,69C 'progress':63C 'releas':112C 'remov':40B,101C 'report':105C 'run':8A,55B 'sanit':7A 'sanitizesvgcont':30B,68C 'script':9A 'svg':5A 'ui':2A,23B,26B,65C 'unsaf':41B,98C 'version':107C,122C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Kendo UI for jQuery and let users or outside data supply custom icon SVG markup are exposed, since the flaw runs during icon creation. Apps that only use built-in icons, or never accept outside icon content, are less exposed. The first affected release is not established, so teams should check any version up to and including the reported `2026.3.1015`.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frontend","high","javascript","jquery","kendoui","package"],"campaign_type":null,"search_a":"'-124690':14A,17A '-2026':13A,16A 'cve':12A,15A 'filter':11A 'icon':6A 'jqueri':4A 'kendo':1A 'run':8A 'sanit':7A 'script':9A 'svg':5A 'ui':2A","search_b":"'attack':44B 'content':50B 'creation':61B 'custom':32B,48B 'dom':38B 'element':42B 'frontend':18B 'get':52B 'icon':33B,49B,60B 'influenc':47B 'javascript':19B,53B 'jqueri':20B,28B 'kendo':22B,25B 'kendo-ui':21B 'live':37B 'markup':34B 'packag':24B 'page':58B 'pars':31B 'remov':40B 'run':55B 'sanitizesvgcont':30B 'ui':23B,26B 'unsaf':41B","search_c":"'2026.3.1015':108C '2026.4.1110':123C 'affect':111C 'attack':81C 'caus':89C 'content':87C 'creation':95C 'custom':70C,85C 'dom':76C 'element':99C 'establish':116C 'execut':92C 'filter':78C 'first':110C 'fix':120C 'icon':71C,86C,94C 'influenc':84C 'issu':103C,118C 'javascript':90C 'jqueri':67C 'kendo':64C 'live':75C 'markup':72C 'pars':69C 'progress':63C 'releas':112C 'remov':101C 'report':105C 'sanitizesvgcont':68C 'ui':65C 'unsaf':98C 'version':107C,122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124690","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124690","severity":null,"published_at":"2026-11-11T17:17:18+00:00","modified_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:21+00:00","fetched_at":"2026-11-11T17:28:21+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}