CVE-2026-124693

CVSS 7.1 (high) · published 2026-11-11

In Progress Kendo UI for jQuery versions 2026.3.1015 up to, but not including, 2026.4.1110, PivotGrid and PivotConfigurator axis field names are passed to a chip template without appropriate encoding. An attacker who can influence an axis field name can cause JavaScript to execute when a user views the rendered chip. The field name can be interpreted as HTML in both attribute and element contexts. Successful exploitation may compromise the confidentiality and integrity of data available in the user's browser context. The first affected release has not been established.

Weakness: CWE-79

Source: NVD CVE-2026-124693

References

• https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-pivotgrid-pivotconfigurator-axis-chip-xss-cve-2026-124693

Check your software

Connect an AI agent to the FixLane MCP server or ask the Telegram bot to check what you have installed against incidents with a verified fixed version.