Is CVE-2026-106147 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106147 being exploited in the wild.

How severe is CVE-2026-106147?

Medium severity, with a CVSS score of 5.4, published 15 October 2026.

Which products and versions are affected?

Progress Kendo UI for jQuery R1 2020 through 2026.3.811.

How is CVE-2026-106147 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106147?

Check whether you run Progress Kendo UI for jQuery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106147: Progress Kendo UI for jQuery ListBox stored XSS via unencoded dataTextField

CVE-2026-106147 · Severity: medium · CVSS 5.4 · Published 2026-10-15

Progress Kendo UI for jQuery is a web framework component used to build interactive data-driven applications. The ListBox component renders user-controlled data without properly encoding it as HTML, allowing an attacker with data modification privileges to inject malicious JavaScript that executes in users' browsers. A successful attack can steal sensitive data or perform unauthorized actions on behalf of the affected user.

Technologies: Progress Kendo UI for jQuery. Vendors: Progress.

Quick answers

Is CVE-2026-106147 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106147 being exploited in the wild.
How severe is CVE-2026-106147?: Medium severity, with a CVSS score of 5.4, published 15 October 2026.
Which products and versions are affected?: Progress Kendo UI for jQuery R1 2020 through 2026.3.811.
Is there a fix for CVE-2026-106147?: Yes: fixed in 2026.3.1015. Until then: If immediate upgrade is not possible, override the ListBox _templates function to HTML-encode the dataTextField value using kendo.htmlEncode() in the default item template. This workaround must be applied after loading Kendo UI but before initializing ListBox widgets, and must be tested for compatibility with custom templates in your specific version. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106147 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106147?: Check whether you run Progress Kendo UI for jQuery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.3.1015

If immediate upgrade is not possible, override the ListBox _templates function to HTML-encode the dataTextField value using kendo.htmlEncode() in the default item template. This workaround must be applied after loading Kendo UI but before initializing ListBox widgets, and must be tested for compatibility with custom templates in your specific version.

Technical details

The ListBox default item template renders the dataTextField value as raw HTML without encoding (CWE-80: Improper Neutralization of Script-Related HTML Tags). An attacker who can modify the bound data source can inject HTML containing event handlers that execute JavaScript when the list item is rendered. This requires authentication or data modification capability and user interaction (viewing the ListBox), but the resulting XSS is stored in the data and affects all users viewing it.

Affected products

Progress Kendo UI for jQuery R1 2020 through 2026.3.811

Timeline

2026-10-15: disclosed: CVE-2026-106147 published

References

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-listbox-bound-text-xss-cve-2026-106147

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.