{"id":"CVE-2026-124693","kind":"vulnerability","aliases":["CVE-2026-124693"],"related":[],"title":"Kendo UI for jQuery: PivotGrid field names allow script injection in browsers","description":"In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.","summary":"Kendo UI for jQuery's PivotGrid and PivotConfigurator insert axis field names into chip templates without encoding them. An attacker who can set an axis field name can run JavaScript in the browser of a user who views the rendered chip.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","jquery","kendo-ui","package"],"not_affected_if":["fixed-field-names","no-pivotgrid","version-outside-range"],"how_to_check":"- Check the installed Kendo UI for jQuery version in `package.json` or the bundled script header; affected range is `2026.3.1015` up to but not including `2026.4.1110`.\n- Look for PivotGrid or PivotConfigurator use in the application where field names can come from user input.","fix":"- Kendo UI for jQuery: move to `2026.4.1110` or later, per the affected range in the sources.","status":"open","published_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","triaged_at":"2026-11-11T17:28:44+00:00","updated_at":"2026-11-11T17:28:44+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T17:28:44Z","model":"claude-haiku-5-5","output":{"fix":"- Kendo UI for jQuery: move to `2026.4.1110` or later, per the affected range in the sources.","reach":"internet","title":"Kendo UI for jQuery: PivotGrid field names allow script injection in browsers","impact":"medium","summary":"Kendo UI for jQuery's PivotGrid and PivotConfigurator insert axis field names into chip templates without encoding them. An attacker who can set an axis field name can run JavaScript in the browser of a user who views the rendered chip.","audience":"developers","category":"package","nicknames":[],"who_cares":["kendo-ui","jquery","javascript","frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in a user's browser and reads or changes their session data","analyst_note":"","how_to_check":"- Check the installed Kendo UI for jQuery version in `package.json` or the bundled script header; affected range is `2026.3.1015` up to but not including `2026.4.1110`.\n- Look for PivotGrid or PivotConfigurator use in the application where field names can come from user input.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["no-pivotgrid","fixed-field-names","version-outside-range"],"who_is_affected":"Applications that use Kendo UI for jQuery PivotGrid or PivotConfigurator and let users or external data influence axis field names. Pages that never render these widgets, or that only use fixed field names, are not exposed. The sources do not say whether the first affected release is known.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.000756,"input_tokens":4644,"output_tokens":584,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124693':15A,18A '-2026':14A,17A '2026.3.1015':74C '2026.4.1110':80C 'affect':150C 'allow':8A 'appropri':94C 'attack':45B,97C 'attribut':127C 'avail':141C 'axi':35B,50B,84C,102C 'browser':12A,58B,146C 'caus':106C 'chip':39B,66B,91C,116C 'compromis':134C 'confidenti':136C 'context':130C,147C 'cve':13A,16A 'data':140C 'element':129C 'encod':42B,95C 'establish':155C 'execut':109C 'exploit':132C 'field':6A,36B,51B,85C,103C,118C 'first':149C 'frontend':19B 'html':124C 'includ':79C 'influenc':100C 'inject':10A 'insert':34B 'integr':138C 'interpret':122C 'javascript':20B,55B,107C 'jqueri':4A,21B,29B,72C 'kendo':1A,23B,26B,69C 'kendo-ui':22B 'may':133C 'name':7A,37B,52B,86C,104C,119C 'packag':25B 'pass':88C 'pivotconfigur':33B,83C 'pivotgrid':5A,31B,81C 'progress':68C 'releas':151C 'render':65B,115C 'run':54B 'script':9A 'set':48B 'success':131C 'templat':40B,92C 'ui':2A,24B,27B,70C 'user':61B,112C,144C 'version':73C 'view':63B,113C 'without':41B,93C","nicknames":[],"mitigations":[],"who_affected":"Applications that use Kendo UI for jQuery PivotGrid or PivotConfigurator and let users or external data influence axis field names. Pages that never render these widgets, or that only use fixed field names, are not exposed. The sources do not say whether the first affected release is known.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"developers","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frontend","high","javascript","jquery","kendoui","package"],"campaign_type":null,"search_a":"'-124693':15A,18A '-2026':14A,17A 'allow':8A 'browser':12A 'cve':13A,16A 'field':6A 'inject':10A 'jqueri':4A 'kendo':1A 'name':7A 'pivotgrid':5A 'script':9A 'ui':2A","search_b":"'attack':45B 'axi':35B,50B 'browser':58B 'chip':39B,66B 'encod':42B 'field':36B,51B 'frontend':19B 'insert':34B 'javascript':20B,55B 'jqueri':21B,29B 'kendo':23B,26B 'kendo-ui':22B 'name':37B,52B 'packag':25B 'pivotconfigur':33B 'pivotgrid':31B 'render':65B 'run':54B 'set':48B 'templat':40B 'ui':24B,27B 'user':61B 'view':63B 'without':41B","search_c":"'2026.3.1015':74C '2026.4.1110':80C 'affect':150C 'appropri':94C 'attack':97C 'attribut':127C 'avail':141C 'axi':84C,102C 'browser':146C 'caus':106C 'chip':91C,116C 'compromis':134C 'confidenti':136C 'context':130C,147C 'data':140C 'element':129C 'encod':95C 'establish':155C 'execut':109C 'exploit':132C 'field':85C,103C,118C 'first':149C 'html':124C 'includ':79C 'influenc':100C 'integr':138C 'interpret':122C 'javascript':107C 'jqueri':72C 'kendo':69C 'may':133C 'name':86C,104C,119C 'pass':88C 'pivotconfigur':83C 'pivotgrid':81C 'progress':68C 'releas':151C 'render':115C 'success':131C 'templat':92C 'ui':70C 'user':112C,144C 'version':73C 'view':113C 'without':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124693","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124693","severity":null,"published_at":"2026-11-11T17:17:18+00:00","modified_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","fetched_at":"2026-11-11T17:28:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}