PT-2026-145277

CVE-2026-124690

·

Published

2026-11-11

·

Updated

2026-11-11

Description by

CVSS 3.1
7.1
High
MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions Kendo UI for jQuery versions prior to 2026.4.1110
Description The sanitizeSvgContent() function parses custom icon markup into a live DOM before filtering it. This allows an attacker who can influence custom icon content to execute JavaScript during the icon creation process, occurring before unsafe elements are removed.
Recommendations Update to version 2026.4.1110.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')
Related identifiers
CVE-2026-124690
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com