# CVE-2026-106151: Progress Kendo UI for jQuery Validator cross-site scripting

Source: https://junglewise.ai/threats/cve-2026-106151-in-progress-kendo-ui-for-jquery-versions-starting-with-2012-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-20  
License: CC BY 4.0 with a link back

CVE-2026-106151 · Severity: medium · CVSS 5.4 · Published 2026-10-15

Progress Kendo UI for jQuery is a web framework used to build interactive user interfaces. The Validator component, which checks user input, incorrectly processes validation error messages that an attacker can control. By injecting malicious code into these messages, an attacker can execute JavaScript in a user's browser, potentially stealing session cookies, passwords, or other sensitive data.

Technologies: [Progress Kendo UI for jQuery](https://junglewise.ai/threats/technologies/kendo-ui-for-jquery), [Progress Kendo Ui](https://junglewise.ai/threats/technologies/kendo-ui). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-106151 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106151 being exploited in the wild.

**How severe is CVE-2026-106151?** Medium severity, with a CVSS score of 5.4, published 15 October 2026.

**Which products and versions are affected?** Progress Kendo UI for jQuery 2012.2.710 through 2026.3.811.

**Is there a fix for CVE-2026-106151?** Yes: fixed in 2026.3.1015. Until then: Ensure validation messages from untrusted sources are not included in data-[rule]-msg attributes, or implement a content security policy (CSP) to restrict inline script execution.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"},{"kind":"advisory","at":"2026-10-14","note":"Telerik advisory published"}] Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106151 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106151?** Check whether you run Progress Kendo UI for jQuery or Progress Kendo Ui at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.3.1015

Ensure validation messages from untrusted sources are not included in data-[rule]-msg attributes, or implement a content security policy (CSP) to restrict inline script execution.</anigation>
<parameter name="timeline">[{"kind":"disclosed","at":"2026-10-15"},{"kind":"advisory","at":"2026-10-14","note":"Telerik advisory published"}]

## Technical details

The Validator component decodes and renders validation messages from data-[rule]-msg HTML attributes as HTML rather than plain text, allowing stored XSS when attacker-controlled content is included in these attributes. Exploitation requires the ability to modify validation messages (e.g., via database tampering or user-supplied data) and user interaction to trigger validation. An attacker gains arbitrary JavaScript execution in the victim's browser context.

## Affected products

- Progress Kendo UI for jQuery 2012.2.710 through 2026.3.811

## References

- [https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-validator-message-xss-cve-2026-106151](https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-validator-message-xss-cve-2026-106151)

## Related threats

- [Progress Telerik Kendo UI for jQuery Chart XSS in tooltip](https://junglewise.ai/threats/cve-2026-124698-in-progress-kendo-ui-for-jquery-the-chart-default-tooltip)
- [Progress Telerik Kendo UI for jQuery Chart XSS in shared-tooltip](https://junglewise.ai/threats/cve-2026-124697-in-progress-kendo-ui-for-jquery-chart-shared-tooltip-rendering)
- [Progress Kendo UI for jQuery Spreadsheet XSS in sheet names](https://junglewise.ai/threats/cve-2026-124696-in-progress-kendo-ui-for-jquery-spreadsheet-sheet-names-are)
- [Progress Telerik Kendo UI jQuery Form cross-site scripting in item hints](https://junglewise.ai/threats/cve-2026-124695-in-progress-kendo-ui-for-jquery-form-the-items-hint-option-is)
- [Progress Telerik Kendo UI for jQuery Gantt cross-site scripting in Parent dropdown](https://junglewise.ai/threats/cve-2026-124691-in-progress-kendo-ui-for-jquery-gantt-the-task-editor-s-parent)