Kendo UI ListBox CVE-2026-106147

Exploitation requires three concrete prerequisites: (1) the application must use the Kendo UI for jQuery ListBox widget with its DEFAULT item template (a custom template that HTML-encodes dataTextField would mitigate this); (2) the attacker must be able to modify the data bound to the widget's dataTextField - i.e., control over a persisted field that is later rendered, consistent with CVSS PR:L; and (3) a victim user must load the view that renders the poisoned list item (UI:R). Limiting factors: this is not remote-unauthenticated - it is a stored/second-order XSS gated by write access to the bound data and by victim rendering, and it only affects versions from R1 2020 up to (not including) 2026.3.1015. Applications binding the ListBox solely to trusted, non-user-controlled data are not realistically exploitable.

This is a medium-severity stored XSS (CWE-80) in the Kendo UI for jQuery ListBox widget, where the default item template renders the bound dataTextField as raw HTML. The vendor CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N = 5.4) is internally consistent with the description: exploitation requires an attacker who can modify the bound data (PR:L - some privilege/write access to the data source), a victim who then renders the affected list item (UI:R), and the injected script executes in the victim's browser context (S:C scope change), yielding limited confidentiality and integrity impact (C:L/I:L) with no availability effect. No EPSS score, CISA KEV listing, POC, or SSVC decision data was provided, so there is no signal of active or probable exploitation - status is 'no public exploit identified at time of analysis.' The signals are not conflicting but they are sparse: the CVSS cleanly reflects a classic second-order/stored XSS that depends on an attacker first being able to influence the bound data, which materially limits real-world risk versus a pre-auth remote flaw. Net assessment: a genuine but moderate-priority web application defect, not a drop-everything emergency - prioritize for applications that bind the ListBox to attacker-influenceable or multi-tenant data.

An attacker with the ability to write to a data field that feeds a ListBox (e.g., a profile name, comment, or label field in a multi-user application) stores a value containing an HTML element with an event handler such as onmouseover or onerror. When another user - potentially an administrator - loads the page and the ListBox renders that item with the default template, the handler fires and executes the attacker's JavaScript in the victim's session. No public exploit code was identified in the provided data.