PT-2026-145264
CVE-2026-124687
·
Published
2026-11-11
·
Updated
2026-11-11
Description by
CVSS 3.1
7.1
HighMetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the
id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111. Found an issue in the description? Have something to add? Feel free to write us 👾