{"affected":[{"defaultStatus":"unaffected","product":"Kendo UI for jQuery","source":"CNA: ProgressSoftware","vendor":"Progress Software","versions":[{"lessThan":"2026.4.1111","status":"affected","version":"2012.1.322","versionType":"custom"}]}],"cveId":"CVE-2026-124688","cwes":["CWE-80"],"description":"In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.","epss":null,"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: ProgressSoftware","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"},{"score":7.1,"severity":"high","source":"NVD: security@progress.com","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","version":"3.1"}],"modifiedAt":1794417437897,"publishedAt":1794415472121,"references":[{"source":"CNA: ProgressSoftware","tags":["vendor-advisory"],"url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-tabstrip-panelbar-menu-spritecssclass-xss-cve-2026-124688"},{"source":"security@progress.com","tags":[],"url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-tabstrip-panelbar-menu-spritecssclass-xss-cve-2026-124688"}],"remediation":[],"revision":"7f0f34199733bd93eb7d5ee9e3992883f8466f7e4d7d5c01bcc0f985311c5a19","sources":[{"modifiedAt":1794415472121,"name":"CNA: ProgressSoftware","retrievedAt":1794416916055,"url":"https://www.cve.org/CVERecord?id=CVE-2026-124688"},{"modifiedAt":1794417437897,"name":"NVD","retrievedAt":1794421061407,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124688"}],"ssvc":null,"status":"published","title":"Cross-Site Scripting via the spriteCssClass Field in Kendo UI for jQuery","updatedAt":1794421061407}