CVE-2026-124693

Name of the Vulnerable Software and Affected Versions Kendo UI for jQuery versions 2026.3.1015 through 2026.4.1109

Description In the PivotGrid and PivotConfigurator components, axis field names are passed to a chip template without proper encoding. This allows an attacker who can control an axis field name to execute arbitrary JavaScript in the browser of a user viewing the rendered chip. The field name can be interpreted as HTML within both attribute and element contexts, potentially compromising the confidentiality and integrity of data in the user's browser context.

Recommendations Update Kendo UI for jQuery to version 2026.4.1110 or later.