JavaScript Code Injection through kendo.init() in Kendo UI for jQuery

published 2026-11-11 18h ago modified 2026-11-11 17h ago also EUVD-2026-123549

cvss: 5.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: —; no EPSS score yet
public exploits: 0; none known

In Progress® Kendo® UI for jQuery versions prior to 2026.4.1111, kendo.init() compiles data-* attribute values with new Function when an invalid JSON object is supplied. An attacker with low privileges who can control these attribute values can inject JavaScript that executes during declarative widget initialization when a user loads or interacts with an affected page. Successful exploitation can compromise the confidentiality and integrity of data accessible in the user's browser context. The issue was reported in version 2022.3.1109; the first affected release has not been established.

Patch / fix

fixed in 1

Progress Software Kendo UI for jQuery 2026.4.1111

Is CVE-2026-124686 in your stack? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

CVSS scores

assigned by	version	score	vector
CNA	3.1	5.4	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected products

Progress Software Kendo UI for jQuery

Classification

Weakness

CWE-95 Improper Neutralization of Directives in Dynamically Evaluated Code

References

telerik.com /kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-init-code-injection-cve-2026-124686
vendor-advisory

Sources

CVE List CVE-2026-124686
NVD CVE-2026-124686

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.