CVE-2026-124696 · Package
NO FIX YET · SEE WHAT TO DO
Kendo UI for jQuery's Spreadsheet puts sheet names unencoded into a SheetsBar attribute, so a crafted sheet name can add an event handler. When a user hovers over the menu button, JavaScript runs in their browser and can reach data in that browser context.
first public Nov 12, 2026 · 1 source
Check it with your coding agent
It reads this page and tells you if your code or app is affected.
Applications that embed the Kendo UI for jQuery Spreadsheet and let users, or outside sources, influence sheet names. The affected range runs from 2024.4.1112 through 2026.3.1015. Apps that do not use the Spreadsheet component or do not accept sheet names from untrusted input are less exposed.
Not affected if no-spreadsheet-widget, trusted-sheet-names
Who cares javascript, jquery, kendo-ui, spreadsheet
@progress/kendo-ui or @progress/kendo-spreadsheet version in package.json and the lockfile2026.4.11112026.4.1111 or laterIn Progress Kendo UI for jQuery, Spreadsheet sheet names are inserted into the SheetsBar menu button's data-sheet-name attribute without encoding. An attacker who can influence a sheet name can inject an event-handler attribute and execute JavaScript when a user hovers over the menu button. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected version is 2024.4.1112; the latest vulnerable version is 2026.3.1015. The issue is fixed in version 2026.4.1111.
This page as .md · .json · CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.
InfraStack checks it against your stack and answers on your report, with the evidence and the fix.