Is CVE-2026-106151 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-106151 being exploited in the wild.

How severe is CVE-2026-106151?

Medium severity, with a CVSS score of 5.4, published 15 October 2026.

Which products and versions are affected?

Progress Kendo UI for jQuery 2012.2.710 through 2026.3.811.

Is there a fix for CVE-2026-106151?

Yes: fixed in 2026.3.1015. Until then: Ensure validation messages from untrusted sources are not included in data-[rule]-msg attributes, or implement a content security policy (CSP) to restrict inline script execution. [{"kind":"disclosed","at":"2026-10-15"},{"kind":"advisory","at":"2026-10-14","note":"Telerik advisory published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-106151 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-106151?

Check whether you run Progress Kendo UI for jQuery or Progress Kendo Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-106151: Progress Kendo UI for jQuery Validator cross-site scripting

CVE-2026-106151 · Severity: medium · CVSS 5.4 · Published 2026-10-15

Progress Kendo UI for jQuery is a web framework used to build interactive user interfaces. The Validator component, which checks user input, incorrectly processes validation error messages that an attacker can control. By injecting malicious code into these messages, an attacker can execute JavaScript in a user's browser, potentially stealing session cookies, passwords, or other sensitive data.

Technologies: Progress Kendo UI for jQuery, Progress Kendo Ui. Vendors: Progress.

Quick answers

Is CVE-2026-106151 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-106151 being exploited in the wild.
How severe is CVE-2026-106151?: Medium severity, with a CVSS score of 5.4, published 15 October 2026.
Which products and versions are affected?: Progress Kendo UI for jQuery 2012.2.710 through 2026.3.811.
Is there a fix for CVE-2026-106151?: Yes: fixed in 2026.3.1015. Until then: Ensure validation messages from untrusted sources are not included in data-[rule]-msg attributes, or implement a content security policy (CSP) to restrict inline script execution.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"},{"kind":"advisory","at":"2026-10-14","note":"Telerik advisory published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106151 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-106151?: Check whether you run Progress Kendo UI for jQuery or Progress Kendo Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

Fixed in: 2026.3.1015

Ensure validation messages from untrusted sources are not included in data-[rule]-msg attributes, or implement a content security policy (CSP) to restrict inline script execution.</anigation> <parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"},{"kind":"advisory","at":"2026-10-14","note":"Telerik advisory published"}]

Technical details

The Validator component decodes and renders validation messages from data-[rule]-msg HTML attributes as HTML rather than plain text, allowing stored XSS when attacker-controlled content is included in these attributes. Exploitation requires the ability to modify validation messages (e.g., via database tampering or user-supplied data) and user interaction to trigger validation. An attacker gains arbitrary JavaScript execution in the victim's browser context.

Affected products

Progress Kendo UI for jQuery 2012.2.710 through 2026.3.811

References

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-validator-message-xss-cve-2026-106151

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.