---
id: "CVE-2026-124692"
page: "https://infrastack.ai/live/CVE-2026-124692"
kind: "vulnerability"
aliases: ["CVE-2026-124692"]
title: "Kendo UI for jQuery: Grid column drag clue runs injected script in browser"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frontend", "javascript", "jquery", "kendo-ui", "package"]
not_affected_if: ["default-config", "static-column-titles"]
published_at: "2026-11-11T17:17:18+00:00"
first_seen_at: "2026-11-11T17:28:22+00:00"
updated_at: "2026-11-11T17:28:45+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124692", "first_seen_at": "2026-11-11T17:28:22+00:00"}]
exploit_sources: []
---

# Kendo UI for jQuery: Grid column drag clue runs injected script in browser

Link for people: https://infrastack.ai/live/CVE-2026-124692 (this .md is for agents)

Kendo UI for jQuery's Grid and TreeList re-parse column header text as HTML while the column-reorder drag clue is shown. An attacker who can set a column field or title in an affected application can run JavaScript in the browser of a user who drags that column header.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kendo UI for jQuery version in your `package.json` or lockfile, such as `@progress/kendo-ui` or `@progress/kendo-grid`
- Look for Grid or TreeList pages with column reordering enabled that show column titles or fields from user-controlled data

## Fix

- Kendo UI for jQuery: move to `2026.4.1110` or later

## Timeline

- 2026-11-11T17:28:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124692

## From the sources

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, the Grid and TreeList column-reorder drag clue reparses header text as HTML. An attacker who can influence a column field or title used by an affected application can cause JavaScript to execute when a user drags a column header while column reordering is enabled. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_