Kendo UI CVE-2026-106150

Exploitation requires an authenticated low-privileged actor (PR:L) who can control the URL value passed to a Kendo UI Splitter, Window, or Tooltip iframe, or the title of a Window iframe, in an application running a vulnerable version (Splitter/Window from 2011.2.804, Tooltip from 2013.1.319, all prior to 2026.3.1015). The specific injection vector is an apostrophe within an iframe URL or a crafted iframe title that breaks out of the attribute context to add HTML attributes/JavaScript event handlers. Exploitation is LIMITED by three factors: the attacker must already have privileges to set those component values, the application must actually render untrusted input into these iframe-backed components, and a separate victim user must interact with the affected component (UI:R) for the injected script to fire - it is not a drive-by, zero-interaction flaw.

This is a moderate-risk stored/reflected XSS (CWE-79) in widely-used Kendo UI for jQuery components (Splitter, Window, Tooltip), best characterized as a real-but-not-urgent issue rather than a high-priority emergency. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) tells a consistent story: network-reachable and low-complexity, but it requires an authenticated low-privileged attacker (PR:L) who can control the vulnerable URL/title values AND requires a victim to interact with the component (UI:R). The scope change (S:C) reflects that injected script executes in another user's browser context, which is why confidentiality and integrity are rated Low rather than None. No EPSS score, CISA KEV listing, POC reference, or SSVC decision data was supplied, so there is no evidence of active exploitation or automatable mass exploitation - exploitation status is therefore 'no public exploit identified at time of analysis.' The CVSS network vector is consistent with the description (attacker-controlled values rendered to another user), with no contradiction between vector and description. The main uncertainty is that EPSS/KEV/POC signals are simply absent from the input, so real-world exploitation likelihood cannot be quantified; the combined PR:L + UI:R prerequisites naturally cap practical risk below what the CWE-79 label alone might suggest.

A low-privileged authenticated user of an application built on Kendo UI for jQuery supplies a crafted iframe URL containing an apostrophe (or a malicious Window iframe title) into a Splitter, Window, or Tooltip component, which is rendered without proper sanitization/encoding. When another user later interacts with that component, the injected JavaScript event handler executes in their browser session, allowing theft or modification of data accessible to that victim. No public exploit code was identified in the provided data, and successful exploitation depends on the victim interacting with the affected component (UI:R).