---
id: "CVE-2026-124690"
page: "https://infrastack.ai/live/CVE-2026-124690"
kind: "vulnerability"
aliases: ["CVE-2026-124690"]
title: "Kendo UI for jQuery: SVG icon sanitizer runs scripts before filtering"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frontend", "javascript", "jquery", "kendo-ui", "package"]
not_affected_if: ["built-in-icons-only", "no-user-supplied-svg"]
published_at: "2026-11-11T17:17:18+00:00"
first_seen_at: "2026-11-11T17:28:21+00:00"
updated_at: "2026-11-11T17:28:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124690", "first_seen_at": "2026-11-11T17:28:21+00:00"}]
exploit_sources: []
---

# Kendo UI for jQuery: SVG icon sanitizer runs scripts before filtering

Link for people: https://infrastack.ai/live/CVE-2026-124690 (this .md is for agents)

Kendo UI for jQuery's sanitizeSvgContent() parses custom icon markup into a live DOM before removing unsafe elements. An attacker who can influence custom icon content can get JavaScript to run in the page during icon creation.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kendo UI for jQuery version in `package.json` or `package-lock.json`, for example with `npm ls @progress/kendo-ui`
- Look for code paths that pass user-supplied or externally sourced SVG into Kendo custom icons
- The first affected release is unknown; the reported version is `2026.3.1015`

## Fix

- Kendo UI for jQuery: move to `2026.4.1110`

## Timeline

- 2026-11-11T17:28:21+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124690

## From the sources

In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_