CVE-2026-106161: Progress Kendo UI for jQuery Badge text XSS via data binding

CVE-2026-106161 · Severity: medium · CVSS 5.4 · Published 2026-10-15

Progress Kendo UI for jQuery is a web component library used to build interactive user interfaces. The Badge component fails to encode HTML in its text() method and data bindings, allowing attackers who control data displayed in badges to inject malicious scripts that execute in users' browsers. This can lead to theft of session cookies, account hijacking, or manipulation of displayed information.

Technologies: Progress Kendo UI for jQuery. Vendors: Progress.

Quick answers

Is CVE-2026-106161 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-106161 being exploited in the wild.
How severe is CVE-2026-106161?
Medium severity, with a CVSS score of 5.4, published 15 October 2026.
Which products and versions are affected?
Progress Kendo UI for jQuery v2020.1.114 through 2026.3.811 (prior to 2026.3.1015).
Is there a fix for CVE-2026-106161?
Yes: fixed in 2026.3.1015. Until then: If immediate upgrade is not possible, apply a JavaScript override to the Badge text() method that encodes string values using kendo.htmlEncode() while rejecting object types; this preserves numeric behavior and prevents the XSS while the application is upgraded. Convert any legitimate object-backed values to plain strings before passing to the Badge method. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-106161 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-106161?
Check whether you run Progress Kendo UI for jQuery at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • Fixed in: 2026.3.1015

If immediate upgrade is not possible, apply a JavaScript override to the Badge text() method that encodes string values using kendo.htmlEncode() while rejecting object types; this preserves numeric behavior and prevents the XSS while the application is upgraded. Convert any legitimate object-backed values to plain strings before passing to the Badge method.

Technical details

The Badge text() method renders string values as raw HTML without sanitization, including values supplied through MVVM data binding (CWE-80). An attacker must be able to modify data bound to a Badge component; the vulnerability requires user interaction (rendering of the affected Badge) and executes in the context of the web application with the user's privileges. Successful exploitation compromises confidentiality and integrity of application data. A fix is available in version 2026.3.1015.

Affected products

  • Progress Kendo UI for jQuery v2020.1.114 through 2026.3.811 (prior to 2026.3.1015)

Timeline

  • 2026-10-15: disclosed

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.