CVE-2026-124692 · Package
NO FIX YET · SEE WHAT TO DO
Kendo UI for jQuery's Grid and TreeList re-parse column header text as HTML while the column-reorder drag clue is shown. An attacker who can set a column field or title in an affected application can run JavaScript in the browser of a user who drags that column header.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Kendo UI for jQuery versions from 2026.3.1015 up to but not including 2026.4.1110, with Grid or TreeList column reordering enabled, and where a column field or title can be influenced by untrusted input. The first affected release has not been established. Applications with fixed column definitions or no column reordering are less exposed.
Not affected if default-config, static-column-titles
Who cares frontend, javascript, jquery, kendo-ui
package.json or lockfile, such as @progress/kendo-ui or @progress/kendo-grid2026.4.1110 or laterIn Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.