{"id":"CVE-2026-124694","kind":"vulnerability","aliases":["CVE-2026-124694"],"related":[],"title":"Kendo UI for jQuery: PropertyGrid lets attacker-supplied values run script in browsers","description":"In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PropertyGrid does not encode bound property values and items[].description in its default configuration. An attacker who can influence either value can cause JavaScript to execute when a user views the grid. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.","summary":"Kendo UI for jQuery's PropertyGrid component does not encode bound property values or items[].description by default, so attacker-controlled values can run JavaScript when a user views the grid. The script can access data available in the user's browser session, including confidentiality and integrity of that data.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["frontend","javascript","jquery","kendo-ui","package"],"not_affected_if":["no-propertygrid","trusted-data-only"],"how_to_check":"- Check the installed Kendo UI for jQuery version (for example in `package.json` or the bundled license header) and compare it with the affected range `2026.3.1015` up to `2026.4.1110`.\n- Find where PropertyGrid is used and whether any bound property values or `items[].description` come from user-controlled input.","fix":"- Kendo UI for jQuery: move to `2026.4.1110` or later.","status":"open","published_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","triaged_at":"2026-11-11T17:28:45+00:00","updated_at":"2026-11-11T17:28:45+00:00","category":"package","confidence":0.7,"triage":{"at":"2026-11-11T17:28:45Z","model":"claude-haiku-5-5","output":{"fix":"- Kendo UI for jQuery: move to `2026.4.1110` or later.","reach":"internet","title":"Kendo UI for jQuery: PropertyGrid lets attacker-supplied values run script in browsers","impact":"high","summary":"Kendo UI for jQuery's PropertyGrid component does not encode bound property values or items[].description by default, so attacker-controlled values can run JavaScript when a user views the grid. The script can access data available in the user's browser session, including confidentiality and integrity of that data.","audience":"businesses","category":"package","nicknames":[],"who_cares":["kendo-ui","jquery","javascript","frontend"],"confidence":0.7,"fix_status":"available","needs_auth":"unknown","worst_case":"script runs in users' browsers and reads or alters their session data","analyst_note":"Confirm whether the default configuration applies to all PropertyGrid uses and the first affected release, using the vendor advisory or NVD entry.","how_to_check":"- Check the installed Kendo UI for jQuery version (for example in `package.json` or the bundled license header) and compare it with the affected range `2026.3.1015` up to `2026.4.1110`.\n- Find where PropertyGrid is used and whether any bound property values or `items[].description` come from user-controlled input.","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["no-propertygrid","trusted-data-only"],"who_is_affected":"Applications that render Kendo UI for jQuery PropertyGrid with property values or item descriptions that an attacker can influence, in the default configuration. Applications that do not use PropertyGrid, or that only show trusted static values in it, are not exposed. The sources do not say when the flaw was first introduced.","user_interaction":"yes","product_ecosystem":"","needs_special_setup":"no","severity_if_unknown":"high"},"cost_usd":0.000784,"input_tokens":4607,"output_tokens":647,"severity_before":"high"},"analyst_status":null,"analyst_note":null,"search":"'-124694':17A,20A '-2026':16A,19A '2026.3.1015':86C '2026.4.1110':92C 'access':63B 'affect':144C 'attack':8A,48B,108C 'attacker-control':47B 'attacker-suppli':7A 'avail':65B,135C 'bound':38B,97C 'browser':14A,70B,140C 'caus':115C 'compon':34B 'compromis':128C 'confidenti':73B,130C 'configur':106C 'context':141C 'control':49B 'cve':15A,18A 'data':64B,78B,134C 'default':45B,105C 'descript':43B,102C 'either':112C 'encod':37B,96C 'establish':149C 'execut':118C 'exploit':126C 'first':143C 'frontend':21B 'grid':59B,124C 'includ':72B,91C 'influenc':111C 'integr':75B,132C 'item':42B,101C 'javascript':22B,53B,116C 'jqueri':4A,23B,31B,84C 'kendo':1A,25B,28B,81C 'kendo-ui':24B 'let':6A 'may':127C 'packag':27B 'progress':80C 'properti':39B,98C 'propertygrid':5A,33B,93C 'releas':145C 'run':11A,52B 'script':12A,61B 'session':71B 'success':125C 'suppli':9A 'ui':2A,26B,29B,82C 'user':56B,68B,121C,138C 'valu':10A,40B,50B,99C,113C 'version':85C 'view':57B,122C","nicknames":[],"mitigations":[],"who_affected":"Applications that render Kendo UI for jQuery PropertyGrid with property values or item descriptions that an attacker can influence, in the default configuration. Applications that do not use PropertyGrid, or that only show trusted static values in it, are not exposed. The sources do not say when the flaw was first introduced.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["frontend","high","javascript","jquery","kendoui","package"],"campaign_type":null,"search_a":"'-124694':17A,20A '-2026':16A,19A 'attack':8A 'attacker-suppli':7A 'browser':14A 'cve':15A,18A 'jqueri':4A 'kendo':1A 'let':6A 'propertygrid':5A 'run':11A 'script':12A 'suppli':9A 'ui':2A 'valu':10A","search_b":"'access':63B 'attack':48B 'attacker-control':47B 'avail':65B 'bound':38B 'browser':70B 'compon':34B 'confidenti':73B 'control':49B 'data':64B,78B 'default':45B 'descript':43B 'encod':37B 'frontend':21B 'grid':59B 'includ':72B 'integr':75B 'item':42B 'javascript':22B,53B 'jqueri':23B,31B 'kendo':25B,28B 'kendo-ui':24B 'packag':27B 'properti':39B 'propertygrid':33B 'run':52B 'script':61B 'session':71B 'ui':26B,29B 'user':56B,68B 'valu':40B,50B 'view':57B","search_c":"'2026.3.1015':86C '2026.4.1110':92C 'affect':144C 'attack':108C 'avail':135C 'bound':97C 'browser':140C 'caus':115C 'compromis':128C 'confidenti':130C 'configur':106C 'context':141C 'data':134C 'default':105C 'descript':102C 'either':112C 'encod':96C 'establish':149C 'execut':118C 'exploit':126C 'first':143C 'grid':124C 'includ':91C 'influenc':111C 'integr':132C 'item':101C 'javascript':116C 'jqueri':84C 'kendo':81C 'may':127C 'progress':80C 'properti':98C 'propertygrid':93C 'releas':145C 'success':125C 'ui':82C 'user':121C,138C 'valu':99C,113C 'version':85C 'view':122C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-11T17:17:18+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","cvss_by":"security@progress.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-124694","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124694","severity":null,"published_at":"2026-11-11T17:17:18+00:00","modified_at":"2026-11-11T17:17:18+00:00","first_seen_at":"2026-11-11T17:28:22+00:00","fetched_at":"2026-11-11T17:28:22+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}