---
id: "CVE-2026-124693"
page: "https://infrastack.ai/live/CVE-2026-124693"
kind: "vulnerability"
aliases: ["CVE-2026-124693"]
title: "Kendo UI for jQuery: PivotGrid field names allow script injection in browsers"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["frontend", "javascript", "jquery", "kendo-ui", "package"]
not_affected_if: ["fixed-field-names", "no-pivotgrid", "version-outside-range"]
published_at: "2026-11-11T17:17:18+00:00"
first_seen_at: "2026-11-11T17:28:22+00:00"
updated_at: "2026-11-11T17:28:44+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-124693", "first_seen_at": "2026-11-11T17:28:22+00:00"}]
exploit_sources: []
---

# Kendo UI for jQuery: PivotGrid field names allow script injection in browsers

Link for people: https://infrastack.ai/live/CVE-2026-124693 (this .md is for agents)

Kendo UI for jQuery's PivotGrid and PivotConfigurator insert axis field names into chip templates without encoding them. An attacker who can set an axis field name can run JavaScript in the browser of a user who views the rendered chip.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Kendo UI for jQuery version in `package.json` or the bundled script header; affected range is `2026.3.1015` up to but not including `2026.4.1110`.
- Look for PivotGrid or PivotConfigurator use in the application where field names can come from user input.

## Fix

- Kendo UI for jQuery: move to `2026.4.1110` or later, per the affected range in the sources.

## Timeline

- 2026-11-11T17:28:22+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-124693

## From the sources

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_