Kendo UI CVE-2026-106148

Exploitation requires that an attacker can control or modify an imageUrl value in the data source consumed by the Kendo UI for jQuery TabStrip, Menu, or PanelBar components (versions prior to 2026.3.1015), and that a victim subsequently loads a page where the affected component renders that image. The specific injection point is the single-quoted image src attribute, into which imageUrl is inserted without escaping, allowing quote breakout and injection of extra HTML attributes/event handlers. Limiting factors: the attacker needs some privilege level to write to the data source (not anonymous), the payload only fires when a user actually renders the component (user interaction required), and applications that sanitize or constrain image URLs upstream, or have upgraded to 2026.3.1015, are not exploitable.

This is a genuine but moderate-priority issue, not a top-tier emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, score 5.4 Medium) indicates network reachability with low attack complexity, but two meaningful brakes: it requires privileges (PR:L) to modify the data source imageUrl value and requires user interaction (UI:R) in the form of a victim rendering the affected component. The scope change (S:C) correctly reflects that injected JavaScript executes in the victim's browser context rather than solely in the vulnerable component, which is typical of XSS. No EPSS score, SSVC decision, KEV listing, or POC indicator was supplied in the input; absence of these is not evidence of safety but means there is no public exploit identified at time of analysis and no signal of active exploitation. There are no conflicting signals here - description (an attacker who can modify an image URL) aligns well with PR:L and the stored/persistent XSS nature. Overall this is a real, patchable defect worth remediating on a normal cycle, not a high-CVSS-but-illusory risk, but it is bounded by the need for data-source write access and victim rendering rather than being wormable or unauthenticated-remote.

An attacker with the ability to influence a data source feeding a Kendo UI TabStrip, Menu, or PanelBar (e.g., a lower-privileged user whose profile or content supplies an image URL) sets imageUrl to a value containing a single quote followed by an injected event handler such as onerror=alert(document.cookie). When another user - potentially an administrator - views the page and the component renders the image src into its single-quoted attribute without escaping, the injected handler fires and runs attacker JavaScript in that victim's session. No public proof-of-concept was provided in the input.