CVE-2026-124687
HIGH
MEDIUM
Priority: 0.01
BB Relevance:
64/100
Published: 2026-11-11
Modified: 2026-11-11
First seen: 2026-11-11
Status: active
Attack Surface
Network
Low Complexity
No Auth
Scope Change
CVSS Vector Breakdown
AV:
Network
AC:
Low
PR:
None
UI:
Required
S:
Changed
C:
Low
I:
Low
A:
Low
Description
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the `id` and `target` attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.
Weakness Classification (1)
Affected Software (1)
| Vendor | Product | Version |
|---|---|---|
| Progress Software | Kendo UI for jQuery | 2022.2.621 < 2026.4.1111 |
References & Advisories (1)
vendor-advisory