High severity7.1NVD Advisory· Published Nov 11, 2026· Updated Nov 11, 2026
CVE-2026-124687
CVE-2026-124687
Description
In Progress® Kendo® UI for jQuery versions from 2022.2.621 prior to 2026.4.1111 the DropDownButton and SplitButton allow markup injection through the id and target attributes. An attacker who can influence these item values can break out of the attributes and inject markup, including event handlers. The issue is fixed in 2026.4.1111.
Affected products
1- Range: from 2022.2.621 prior to 2026.4.1111
Patches
Vulnerability mechanics
References
1News mentions
0No linked articles in our index yet.