CVE-2026-106161 Progress Software CVE debrief

Who should care

Defenders responsible for applications using Kendo UI for jQuery, especially those with user-supplied data bound to Badge components, should assess exposure and prioritize patching or compensating controls.

Why it matters

CVE-2026-106161 is a medium-severity vulnerability in Progress Kendo UI for jQuery that allows for JavaScript execution and data compromise. Defenders should prioritize verifying exposure in applications using Kendo UI for jQuery, especially those with user-supplied data bound to Badge components, and apply the fixed version 2026.3.1015 or implement compensating controls to mitigate the risk.

• Execution of arbitrary JavaScript in users' browsers
• Potential compromise of data confidentiality and integrity
• Risk of XSS attacks through user-supplied data
• Need for verification of affected versions and exposure

Technical summary

The vulnerability exists in the Badge text method of Progress Kendo UI for jQuery, which renders string values as raw HTML without encoding. This allows an attacker to supply HTML containing event handlers that execute JavaScript in a user's browser when the Badge renders the value. The issue affects versions from 2020.1.114 to 2026.3.1015 and is fixed in version 2026.3.1015. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. The vulnerability has a CVSS score of 5.4 and a severity of MEDIUM.

Defensive priority

Defenders should prioritize verifying exposure in applications using Kendo UI for jQuery, especially those with user-supplied data bound to Badge components. They should assess the risk of JavaScript execution and data compromise, and apply the fixed version 2026.3.1015 or implement compensating controls to mitigate the risk.

Recommended defensive actions

• Verify if applications using Kendo UI for jQuery are exposed to user-supplied data that can be bound to Badge components.
• Assess the risk of JavaScript execution and data compromise in affected applications.
• Apply the fixed version 2026.3.1015 or implement compensating controls to mitigate the risk.
• Monitor applications for suspicious activity related to Badge component rendering.
• Update inventory records to reflect the use of Kendo UI for jQuery and prioritize patching.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, affected versions, and fixed version. A vendor advisory is available with additional information. The vulnerability affects Progress Kendo UI for jQuery versions from 2020.1.114 to 2026.3.1015. Defenders should verify exposure in applications using Kendo UI for jQuery, especially those with user-supplied data bound to Badge components, and assess the risk of JavaScript execution and data compromise. The fixed version is 2026.3.1015. Evidence limits are based on CVE and

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.