{"id":"CVE-2026-106157","summary":"Cross-Site Scripting via PanelBar Item URLs in Kendo UI for jQuery","details":"In Progress® Kendo® UI for jQuery versions starting with 2019.2.514 and prior to 2026.3.1015, the PanelBar component inserts data source item URL values into a single-quoted href attribute without proper encoding. An attacker who can control an item URL can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected item is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.","modified":"2026-10-28T02:30:50.357658732Z","published":"2026-10-15T13:21:27.532Z","database_specific":{"unresolved_ranges":[{"extracted_events":[{"strategy":"StandardRange","range":[{"introduced":"2019.2.514"},{"fixed":"2026.3.1015"}],"source":"AFFECTED_FIELD"}]}],"cna_assigner":"ProgressSoftware","cwe_ids":["CWE-80"],"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106157.json"},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106157.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106157"},{"type":"ADVISORY","url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-panelbar-url-xss-cve-2026-106157"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/telerik/kendo-ui-core","events":[{"introduced":"1b52c6745143c4fa7f0dc24d411aea4f8ae885c8"},{"fixed":"c324e79576cc977b9f40e8a56f8ab1ccae4a10cf"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*","range":[{"introduced":"2019.2.514"},{"fixed":"2026.3.1015"}],"source":"CPE_RANGE"}]}}],"versions":["2025.3.825","2025.1.227","2023.3.1010","2021.3.1207","2021.3.914","2021.2.511","2021.1.119","2020.3.915","2020.1.114","2019.3.917","2019.2.514"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106157.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}