{"id":"CVE-2026-106159","summary":"Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery","details":"In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing whitespace and additional attributes, including an event handler, and execute JavaScript in a user's browser when the affected button is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.","modified":"2026-10-28T02:30:59.700746807Z","published":"2026-10-15T13:23:40.132Z","database_specific":{"osv_generated_from":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106159.json","unresolved_ranges":[{"extracted_events":[{"range":[{"introduced":"2022.3.1109"},{"fixed":"2026.3.1015"}],"source":"AFFECTED_FIELD","strategy":"StandardRange"}]}],"cna_assigner":"ProgressSoftware","cwe_ids":["CWE-80"]},"references":[{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/106xxx/CVE-2026-106159.json"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-106159"},{"type":"ADVISORY","url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-toolbar-buttongroup-url-xss-cve-2026-106159"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/telerik/kendo-ui-core","events":[{"introduced":"0720b5ce1915302d136c7494f63f0dc627217254"},{"fixed":"c324e79576cc977b9f40e8a56f8ab1ccae4a10cf"}],"database_specific":{"extracted_events":[{"cpe":"cpe:2.3:a:progress:kendo_ui:*:*:*:*:*:*:*:*","range":[{"introduced":"2022.3.1109"},{"fixed":"2026.3.1015"}],"source":"CPE_RANGE"}]}}],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-106159.json"}}],"schema_version":"1.9.2","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}