# CVE-2026-106157: Progress Kendo UI for jQuery PanelBar XSS in item URLs

Source: https://junglewise.ai/threats/cve-2026-106157-in-progress-kendo-ui-for-jquery-versions-starting-with-2019-2  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-15. Updated: 2026-10-16  
License: CC BY 4.0 with a link back

CVE-2026-106157 · Severity: medium · CVSS 4.7 · Published 2026-10-15

Progress Kendo UI for jQuery is a UI component library used in web applications. The PanelBar component fails to properly encode user-controlled URLs, allowing an attacker to inject malicious HTML and JavaScript code. When a user interacts with a compromised menu item, the injected script executes in their browser, potentially stealing session data or modifying application content.

Technologies: [Progress Kendo UI for jQuery](https://junglewise.ai/threats/technologies/kendo-ui-for-jquery). Vendors: [Progress](https://junglewise.ai/threats/vendors/progress).

## Quick answers

**Is CVE-2026-106157 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-106157 being exploited in the wild.

**How severe is CVE-2026-106157?** Medium severity, with a CVSS score of 4.7, published 15 October 2026.

**Which products and versions are affected?** Progress Kendo UI for jQuery 2019.2.514 to 2026.3.811.

**Is there a fix for CVE-2026-106157?** Yes: fixed in 2026.3.1015. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-106157 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-106157?** Check whether you run Progress Kendo UI for jQuery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in 2026.3.1015

## Technical details

The PanelBar component's item template inserts data source URL values directly into single-quoted href attributes without proper HTML encoding (CWE-80 Basic XSS). An attacker who can control the item URL in the data source can inject additional HTML attributes and event handlers. Exploitation requires network access and user interaction (clicking the affected menu item); no authentication is needed.

## Affected products

- Progress Kendo UI for jQuery 2019.2.514 to 2026.3.811

## Timeline

- 2026-10-15: disclosed

## References

- [https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-panelbar-url-xss-cve-2026-106157](https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-panelbar-url-xss-cve-2026-106157)

## Related threats

- [Progress Telerik Kendo UI for jQuery Chart XSS in tooltip](https://junglewise.ai/threats/cve-2026-124698-in-progress-kendo-ui-for-jquery-the-chart-default-tooltip)
- [Progress Telerik Kendo UI for jQuery Chart XSS in shared-tooltip](https://junglewise.ai/threats/cve-2026-124697-in-progress-kendo-ui-for-jquery-chart-shared-tooltip-rendering)
- [Progress Kendo UI for jQuery Spreadsheet XSS in sheet names](https://junglewise.ai/threats/cve-2026-124696-in-progress-kendo-ui-for-jquery-spreadsheet-sheet-names-are)
- [Progress Telerik Kendo UI jQuery Form cross-site scripting in item hints](https://junglewise.ai/threats/cve-2026-124695-in-progress-kendo-ui-for-jquery-form-the-items-hint-option-is)
- [Progress Telerik Kendo UI for jQuery Gantt cross-site scripting in Parent dropdown](https://junglewise.ai/threats/cve-2026-124691-in-progress-kendo-ui-for-jquery-gantt-the-task-editor-s-parent)