CVE-2026-106157 Progress CVE debrief

Who should care

Defenders responsible for Kendo UI for jQuery deployments, especially those using the PanelBar component, should assess exposure and prioritize updating to version 2026.3.1015 or later.

Why it matters

CVE-2026-106157 is a medium-severity vulnerability in Progress Kendo UI for jQuery that allows an attacker to execute JavaScript in a user's browser, compromising data confidentiality and integrity. Defenders should prioritize verifying exposure and updating to a fixed version.

• Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application
• An attacker can inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser
• Defenders need to verify exposure in their Kendo UI for jQuery deployments and update to a fixed version

Technical summary

The PanelBar component in Progress Kendo UI for jQuery versions from 2019.2.514 to 2026.3.1015 improperly encodes data source item URL values into a single-quoted href attribute. This allows an attacker to inject additional HTML attributes, including event handlers, and execute JavaScript in a user's browser when the affected item is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. Defenders should prioritize verifying exposure in their Kendo UI for jQuery deployments, especially those using the PanelBar component, and update to version 2026.3.1015 or later.

Defensive priority

Defenders should prioritize verifying exposure in their Kendo UI for jQuery deployments, especially those using the PanelBar component, and update to version 2026.3.1015 or later.

Recommended defensive actions

• Verify Kendo UI for jQuery version and update to 2026.3.1015 or later if using an affected version
• Review and sanitize data source item URLs used in the PanelBar component
• Monitor for suspicious activity related to the PanelBar component
• Perform a thorough review of the system to identify potential entry points for attackers
• Implement additional security measures such as input validation and output encoding
• Conduct regular security audits to detect and address vulnerabilities
• Keep software and systems up to date with the latest security patches

Evidence notes

The CVE record and NVD entry provide details on the vulnerability, including its description, affected versions, and fixed version. A vendor advisory is also available. Progress Kendo UI for jQuery versions from 2019.2.514 to 2026.3.1015 are affected. The PanelBar component improperly encodes data source item URL values. Defenders should verify exposure and review data source item URLs used in the PanelBar component.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.