CVE-2026-124694 · Package
NO FIX YET · SEE WHAT TO DO
Kendo UI for jQuery's PropertyGrid component does not encode bound property values or items[].description by default, so attacker-controlled values can run JavaScript when a user views the grid. The script can access data available in the user's browser session, including confidentiality and integrity of that data.
first public Nov 11, 2026 · 1 source
Could this affect your app?
Free first check from your website. Connect your repo for the full answer.
Applications that render Kendo UI for jQuery PropertyGrid with property values or item descriptions that an attacker can influence, in the default configuration. Applications that do not use PropertyGrid, or that only show trusted static values in it, are not exposed. The sources do not say when the flaw was first introduced.
Not affected if no-propertygrid, trusted-data-only
Who cares frontend, javascript, jquery, kendo-ui
package.json or the bundled license header) and compare it with the affected range 2026.3.1015 up to 2026.4.1110.items[].description come from user-controlled input.2026.4.1110 or later.In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Check it with your coding agent
It reads this page and tells you if your code is affected.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.