{"id":"CVE-2026-124690","aliases":["EUVD-2026-123600","GHSA-r2wf-fj2x-9c4c"],"status":"published","title":"Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization","description":"In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.","severity":{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-13","score":0.00192,"percentile":0.08947,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2026-11-11T16:50:59Z","modified":"2026-11-11T18:31:46Z","products":[{"vendor":"progress software","product":"kendo ui for jquery"}],"references":[{"url":"https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-svg-icon-sanitizer-xss-cve-2026-124690","tags":["vendor-advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-124690"},{"url":"https://github.com/advisories/GHSA-r2wf-fj2x-9c4c"}],"sources":{"cve":[{"id":"CVE-2026-124690","title":"Cross-Site Scripting During Kendo UI for jQuery Custom SVG Icon Sanitization","description":"In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.","status":"published","published":"2026-11-11T16:50:59.752Z","modified":"2026-11-11T16:50:59.752Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T17:30:35.882042Z"}],"euvd":[{"id":"EUVD-2026-123600","description":"In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.","status":"published","published":"2026-11-11T16:50:59Z","modified":"2026-11-11T16:50:59Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-11T20:30:22.572562Z"}],"ghsa":[{"id":"GHSA-r2wf-fj2x-9c4c","title":"In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM...","description":"In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.","status":"published","published":"2026-11-11T18:31:37Z","modified":"2026-11-11T18:31:46Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T18:35:38.720583Z"}],"nvd":[{"id":"CVE-2026-124690","description":"In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.","status":"published","published":"2026-11-11T17:17:18.08Z","modified":"2026-11-11T17:17:18.193Z","cvss":[{"version":"3.1","score":7.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L","level":"high","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-11T19:25:58.374679Z"}]}}