CVE-2026-124695 · Package
NO FIX YET · SEE WHAT TO DO
The Kendo UI for jQuery Form widget renders each item's hint option as HTML even though it is documented as plain text. An attacker who can set a form item's hint can make script run in the browser of anyone who views the form, exposing data in that browser session.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that use the Kendo UI for jQuery Form widget and put text into a form item's hint from anything an outside user can influence, such as stored profile data, admin-entered labels or query parameters. Applications that hard-code all hint text, or do not use the Form widget, are not exposed.
Not affected if hardcoded-hints, no-form-widget, not-kendo-jquery
Who cares frontend, javascript, jquery, kendo-ui
package.json or lockfile; versions from 2020.2.513 through 2026.3.1015 are affected.items[].hint or the Form widget's items configuration, and check whether any hint value comes from user input or a database.2026.4.1111.In Progress Kendo UI for jQuery Form, the items[].hint option is documented as a string but is rendered as HTML. An attacker who can influence a Form item's hint can cause attacker-controlled markup to execute as JavaScript when a user views the rendered form. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2020.2.513; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.