{"id":"CVE-2026-124692","kind":"vulnerability","aliases":["CVE-2026-124692"],"related":[],"title":"Kendo UI for jQuery: Grid column drag clue runs injected script in browser","description":"In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.","summary":"Kendo UI for jQuery's Grid and TreeList re-parse column header text as HTML while the column-reorder drag clue is shown. An attacker who can set a column field or title in an affected application can run JavaScript in the browser of a user who drags that column header.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","jquery","kendo-ui","package"],"not_affected_if":["default-config","static-column-titles"],"how_to_check":"- Check the installed Kendo UI for jQuery version in your `package.json` or lockfile, such as `@progress/kendo-ui` or `@progress/kendo-grid`\n- Look for Grid or TreeList pages with column reordering enabled that show column titles or fields from user-controlled data","fix":"- Kendo UI for jQuery: move to `2026.4.1110` or later","status":"open","published_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","triaged_at":"2026-11-11T17:28:45+00:00","updated_at":"2026-11-11T17:28:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T17:28:45Z","model":"claude-haiku-5-5","output":{"fix":"- Kendo UI for jQuery: move to `2026.4.1110` or later","reach":"internet","title":"Kendo UI for jQuery: Grid column drag clue runs injected script in browser","impact":"high","summary":"Kendo UI for jQuery's Grid and TreeList re-parse column header text as HTML while the column-reorder drag clue is shown. An attacker who can set a column field or title in an affected application can run JavaScript in the browser of a user who drags that column header.","audience":"developers","category":"package","nicknames":[],"who_cares":["kendo-ui","jquery","javascript","frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in user's browser, reads and alters page data","analyst_note":"","how_to_check":"- Check the installed Kendo UI for jQuery version in your `package.json` or lockfile, such as `@progress/kendo-ui` or `@progress/kendo-grid`\n- Look for Grid or TreeList pages with column reordering enabled that show column titles or fields from user-controlled data","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["default-config","static-column-titles"],"who_is_affected":"Applications that use Kendo UI for jQuery versions from `2026.3.1015` up to but not including `2026.4.1110`, with Grid or TreeList column reordering enabled, and where a column field or title can be influenced by untrusted input. The first affected release has not been established. Applications with fixed column definitions or no column reordering are less exposed.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000757,"input_tokens":4627,"output_tokens":589,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124692':16A,19A '-2026':15A,18A '2026.3.1015':87C '2026.4.1110':93C 'affect':64B,121C,159C 'applic':65B,122C 'attack':53B,109C 'avail':150C 'browser':13A,71B,155C 'caus':124C 'clue':8A,49B,102C 'column':6A,38B,46B,58B,78B,99C,114C,133C,136C 'column-reord':45B,98C 'compromis':143C 'confidenti':145C 'context':156C 'cve':14A,17A 'data':149C 'drag':7A,48B,76B,101C,131C 'enabl':139C 'establish':164C 'execut':127C 'exploit':141C 'field':59B,115C 'first':158C 'frontend':20B 'grid':5A,32B,95C 'header':39B,79B,104C,134C 'html':42B,107C 'includ':92C 'influenc':112C 'inject':10A 'integr':147C 'javascript':21B,68B,125C 'jqueri':4A,22B,30B,85C 'kendo':1A,24B,27B,82C 'kendo-ui':23B 'may':142C 'packag':26B 'pars':37B 'progress':81C 're':36B 're-pars':35B 'releas':160C 'reorder':47B,100C,137C 'repars':103C 'run':9A,67B 'script':11A 'set':56B 'shown':51B 'success':140C 'text':40B,105C 'titl':61B,117C 'treelist':34B,97C 'ui':2A,25B,28B,83C 'use':118C 'user':74B,130C,153C 'version':86C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Kendo UI for jQuery versions from `2026.3.1015` up to but not including `2026.4.1110`, with Grid or TreeList column reordering enabled, and where a column field or title can be influenced by untrusted input. The first affected release has not been established. Applications with fixed column definitions or no column reordering are less exposed.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frontend","high","javascript","jquery","kendoui","package"],"campaign_type":null,"search_a":"'-124692':16A,19A '-2026':15A,18A 'browser':13A 'clue':8A 'column':6A 'cve':14A,17A 'drag':7A 'grid':5A 'inject':10A 'jqueri':4A 'kendo':1A 'run':9A 'script':11A 'ui':2A","search_b":"'affect':64B 'applic':65B 'attack':53B 'browser':71B 'clue':49B 'column':38B,46B,58B,78B 'column-reord':45B 'drag':48B,76B 'field':59B 'frontend':20B 'grid':32B 'header':39B,79B 'html':42B 'javascript':21B,68B 'jqueri':22B,30B 'kendo':24B,27B 'kendo-ui':23B 'packag':26B 'pars':37B 're':36B 're-pars':35B 'reorder':47B 'run':67B 'set':56B 'shown':51B 'text':40B 'titl':61B 'treelist':34B 'ui':25B,28B 'user':74B","search_c":"'2026.3.1015':87C '2026.4.1110':93C 'affect':121C,159C 'applic':122C 'attack':109C 'avail':150C 'browser':155C 'caus':124C 'clue':102C 'column':99C,114C,133C,136C 'column-reord':98C 'compromis':143C 'confidenti':145C 'context':156C 'data':149C 'drag':101C,131C 'enabl':139C 'establish':164C 'execut':127C 'exploit':141C 'field':115C 'first':158C 'grid':95C 'header':104C,134C 'html':107C 'includ':92C 'influenc':112C 'integr':147C 'javascript':125C 'jqueri':85C 'kendo':82C 'may':142C 'progress':81C 'releas':160C 'reorder':100C,137C 'repars':103C 'success':140C 'text':105C 'titl':117C 'treelist':97C 'ui':83C 'use':118C 'user':130C,153C 'version':86C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124692","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124692","severity":null,"published_at":"2026-11-11T17:17:18+00:00","modified_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","fetched_at":"2026-11-11T17:28:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}