{"id":"CVE-2026-106159","revision":"65b5e1815af64dbaa310441c2a3a80c1","records":[{"revision":"65b5e1815af64dbaa310441c2a3a80c1","observedAt":"2026-10-23T15:48:27.903+00:00","statement":{"source":"cve-program","id":"CVE-2026-106159","aliases":[],"title":"Cross-Site Scripting via ToolBar ButtonGroup URLs in Kendo UI for jQuery","description":"In Progress® Kendo® UI for jQuery versions starting with 2022.3.1109 and prior to 2026.3.1015, ToolBar ButtonGroup button URLs are concatenated into an unquoted href attribute after URL sanitization. An attacker who can control a button URL can supply an otherwise allowed HTTPS URL containing whitespace and additional attributes, including an event handler, and execute JavaScript in a user's browser when the affected button is interacted with. Successful exploitation can compromise the confidentiality and integrity of data accessible to the affected application. This issue is fixed in version 2026.3.1015.","state":0,"publishedAt":"2026-10-15T13:23:40.132+00:00","modifiedAt":"2026-10-15T18:26:53.924+00:00","affected":[{"ecosystem":"Vendor product","name":"Kendo UI for jQuery","ranges":[],"versions":[],"rawVersionEvidence":"{\n                    \"vendor\": \"Progress Software\",\n                    \"product\": \"Kendo UI for jQuery\",\n                    \"versions\": [\n                        {\n                            \"status\": \"affected\",\n                            \"version\": \"2022.3.1109\",\n                            \"lessThan\": \"2026.3.1015\",\n                            \"versionType\": \"custom\"\n                        }\n                    ],\n                    \"defaultStatus\": \"unaffected\"\n                }"}],"metrics":[{"system":"CVSS 3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N","score":4.7,"severity":"MEDIUM"}],"references":["https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-toolbar-buttongroup-url-xss-cve-2026-106159"],"sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-106159","license":"CVE Program Terms of Use","key":"cve-program:CVE-2026-106159","identifiers":["CVE-2026-106159"]},"retained":false,"historicalAffected":[]}],"coverage":[]}