CVE-2026-106147 Progress Software CVE debrief

Who should care

Defenders responsible for Kendo UI for jQuery deployments, especially those using ListBox components, should assess exposure and apply the patch to prevent potential JavaScript injection attacks.

Why it matters

CVE-2026-106147 is a medium-severity vulnerability in Progress Kendo UI for jQuery that allows for JavaScript injection attacks via the ListBox component. Defenders should prioritize verifying exposure and applying the patch to prevent potential attacks.

• Potential JavaScript injection attacks via ListBox component
• Compromise of data confidentiality and integrity

Technical summary

The ListBox default item template in Progress Kendo UI for jQuery renders bound dataTextField values as raw HTML without encoding, allowing for JavaScript injection attacks. This occurs in versions from R1 2020 to 2026.3.1015. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The issue is fixed in version 2026.3.1015. Defenders should prioritize verifying exposure and applying the patch to prevent potential attacks. The vulnerability has a medium severity with a CVSS score of 5.4.

Defensive priority

Defenders should prioritize verifying exposure in their Kendo UI for jQuery deployments, especially those using ListBox components, and apply the patch to prevent potential JavaScript injection attacks.

Recommended defensive actions

• Verify Kendo UI for jQuery version and apply patch 2026.3.1015 if vulnerable
• Review ListBox component usage and data binding practices
• Monitor for potential JavaScript injection attacks
• Perform a thorough review of the affected component's usage in the environment
• Check for any existing mitigations or compensating controls
• Review relevant monitoring, detection, and logs for exposed assets
• Track exceptions and retest remediated assets

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version 2026.3.1015. A vendor advisory from Progress is available with additional information. Defenders should verify exposure in their Kendo UI for jQuery deployments, especially those using ListBox components, and apply the patch to prevent potential JavaScript injection attacks. The vulnerability allows for JavaScript injection via the ListBox component, compromising data confidentiality and integrity. Evidence is limited to public CVE,

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.