CVE-2026-124688

In Progress® Kendo® UI for jQuery prior to 2026.4.1111 the TabStrip, PanelBar, and Menu widgets support mapping a dataSource field to `spriteCssClass`. If an attacker can control the mapped data, they can break out of the attribute and inject markup, including event-handler attributes. The resulting JavaScript executes in the application's origin when a victim loads a page that renders the affected widget, allowing access to data and actions available in the victim's authenticated session.

• CWE-80

• https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-tabstrip-panelbar-menu-spritecssclass-xss-cve-2026-124688

Published

Nov 11, 2026

Last Modified

Nov 11, 2026

Status

Awaiting Analysis

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2026-12468Race in Updater in Google Chrome on Mac prior to 149.0.7827.…8.3
• CVE-2026-124680Interpretation Conflict, resulting in (Incorrect Authorizati…7
• CVE-2026-124683Eclipse Langium versions 3.2.0 through 4.4.0 contain an inef…8.7
• CVE-2026-124684This issue can cause a heap-use-after-free when an embedder …5.1
• CVE-2026-124686In Progress® Kendo® UI for jQuery versions prior to 2026.4.1…5.4
• CVE-2026-124687In Progress® Kendo® UI for jQuery versions from 2022.2.621 p…7.1
• CVE-2026-124689In Progress Kendo UI for jQuery versions 2026.3.1014 up to, …7.1
• CVE-2026-12469Uninitialized Use in GPU in Google Chrome on Android prior t…4.3
• CVE-2026-124690In Progress Kendo UI for jQuery, sanitizeSvgContent() parses…7.1
• CVE-2026-124691In Progress Kendo UI for jQuery Gantt, the task editor's Par…7.1
• CVE-2026-124692In Progress Kendo UI for jQuery versions 2026.3.1015 up to, …7.1
• CVE-2026-124693In Progress Kendo UI for jQuery versions 2026.3.1015 up to, …7.1