cve.bz

CVE-2026-124688 Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery

7.1 highEPSS 0.2%

High (7.1) in progress software kendo ui for jquery. EPSS 0.2% estimated probability of exploitation activity in the next 30 days.

On this page
In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.

Severity

CVSS 3.1

7.1 high
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
EPSS
0.2% estimated probability of exploitation activity in the next 30 days; 9th percentile. Scored 2026-11-13. A forecast for this CVE across the internet, not for your own systems.
CWE
CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page
OWASP Top 10
A05:2025 Injection
Published
Modified
Assigned by
ProgressSoftware (CNA)
NVD analysis
Awaiting analysis
Record from
the NVD, synced

Ask an AI about this CVE

ChatGPTClaudeGoogle AI Mode

Show the promptExplain CVE-2026-124688 for an engineer deciding whether to act. Use https://cve.bz/api/public/cves/CVE-2026-124688?via=ask-ai-copy and https://cve.bz/cve/CVE-2026-124688?via=ask-ai-copy as the source of truth: what is affected and which versions fix it, whether it is in CISA KEV, public exploits, and its EPSS (an internet-wide 30-day estimate of exploitation activity, not a forecast for my systems). If they give no fixed versions, use the CVE record https://cveawg.mitre.org/api/cve/CVE-2026-124688 or the vendor advisory, not third-party mirrors. Tell me how to check whether I am affected and how to verify a fix. Cite the sources and say where they are uncertain.

Opens a third-party assistant; its answer is its own, not cve.bz's. The prompt holds only this CVE's id and public links.

Badge for a README or a site

CVE-2026-124688

An image that stays current: it is drawn from the data each time it is fetched (a host that proxies images, as GitHub does, may show its copy for a while). Markdown:

[![CVE-2026-124688](https://cve.bz/cve/badge/CVE-2026-124688.svg)](https://cve.bz/cve/CVE-2026-124688)

HTML:

<a href="https://cve.bz/cve/CVE-2026-124688"><img src="https://cve.bz/cve/badge/CVE-2026-124688.svg" alt="CVE-2026-124688"></a>

Affected

  • progress software:kendo ui for jquery

Versions

From the CNA's record in the CVE List.

ProductAffected
Progress Software Kendo UI for jQueryfrom 2012.1.322 before 2026.4.1111

Attack patterns (CAPEC)

  • CAPEC-18 XSS Targeting Non-Script Elements Likelihood: High · Severity: Very High
  • CAPEC-32 XSS Through HTTP Query Strings Likelihood: High · Severity: High
  • CAPEC-86 XSS Through HTTP Headers Likelihood: High · Severity: Very High
  • CAPEC-193 PHP Remote File Inclusion Likelihood: High · Severity: High

The attack patterns MITRE's CAPEC relates to this record's weaknesses, as MITRE names them. Credits.

References

Check your stackJSON