CVE-2026-124693 · Package
NO FIX YET · SEE WHAT TO DO
Kendo UI for jQuery's PivotGrid and PivotConfigurator insert axis field names into chip templates without encoding them. An attacker who can set an axis field name can run JavaScript in the browser of a user who views the rendered chip.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that use Kendo UI for jQuery PivotGrid or PivotConfigurator and let users or external data influence axis field names. Pages that never render these widgets, or that only use fixed field names, are not exposed. The sources do not say whether the first affected release is known.
Not affected if fixed-field-names, no-pivotgrid, version-outside-range
Who cares frontend, javascript, jquery, kendo-ui
package.json or the bundled script header; affected range is 2026.3.1015 up to but not including 2026.4.1110.2026.4.1110 or later, per the affected range in the sources.In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.