CVE-2026-106148: Cross-Site Scripting via TabStrip, Menu and PanelBar Image URLs in Kendo UI for jQuery

The TabStrip, Menu and PanelBar components insert data source imageUrl values into single-quoted image src attributes without proper escaping. An attacker who can modify an image URL can inject extra HTML attributes, including event handlers, and run JavaScript when the component renders the image.

CVE ID

CVE-2026-106148

Vendor

Progress Kendo UI for jQuery

Product

Kendo UI for jQuery

Weakness

CWE-80 — Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

CVSS 3.1

5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected

2011.2.804 through 2026.3.1014

Fixed in

2026.3.1015

Published

Oct 15, 2026

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz) — finder · co-credited with komyeonghane320f9, HanTul

Assigner (CNA)

Progress Software

Remediation

Upgrade Kendo UI for jQuery to 2026.3.1015 or later.

References

About this disclosure

This vulnerability was found and reported by Abhishek Nandkumar Bhaskar (Abhi HackZ, credited in the CVE record as Abhi-Hackz) through the vendor's vulnerability disclosure program, and credited to him as finder in the official CVE record assigned by Progress Software as the CVE Numbering Authority. This record also credits komyeonghane320f9, HanTul as finders. Proof-of-concept details are withheld; the facts on this page are taken from the public CVE record and the vendor advisory. For the background and the bug class explained, read Four CVEs in Progress Software Products and From a Bugcrowd VDP Report to a Published CVE.

Other CVEs credited to Abhishek Bhaskar