Kendo UI CVE-2026-106153

Exploitation requires the application to use the Kendo UI for jQuery Calendar or MultiViewCalendar widget with a month content template that renders data.url and/or data.title, and the attacker must have low-privilege ability to control the 'url' option value or the culture-derived 'title' values bound into that template (per CVSS PR:L). A victim user must then interact with the affected calendar for the injected javascript: URL or event-handler attribute to execute (CVSS UI:R). Limiting factors: this is not remote-unauthenticated - it needs attacker write access to the templated values, user interaction, and a vulnerable version prior to 2026.3.1015; applications that do not expose user-controllable url/title values to the calendar template, or that have upgraded, are not exploitable.

This is a medium-severity stored/DOM cross-site scripting flaw (CWE-79) whose signals are internally consistent and point to a moderate, conditional risk rather than an urgent mass-exploitation threat. The provided CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) indicates a network-reachable but privilege- and interaction-gated issue: the attacker needs PR:L (some authenticated/low-privilege ability to control the Calendar/MultiViewCalendar 'url' option or culture-derived 'title' values) and a victim must interact with the affected calendar (UI:R). The changed scope (S:C) and Low confidentiality/integrity impact reflect script execution in the victim's browser context affecting data beyond the vulnerable component, with no availability impact (A:N). No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is: no public exploit identified at time of analysis. There are no conflicting signals here - the CVSS vector aligns with the description (both require attacker-controlled input plus victim interaction). The practical risk is real but bounded: it is a client-side injection requiring both low-privilege write access to specific template-bound values and a user to trigger the rendering, making it more suited to targeted abuse (e.g., a malicious low-privileged tenant/user attacking other users) than internet-wide automated exploitation. Prioritize patching in multi-tenant or user-content-driven deployments of Kendo UI for jQuery; it is not a drop-everything issue for single-trust-boundary internal apps.

A low-privileged user of a web application built with Kendo UI for jQuery supplies a malicious 'url' value (e.g., a javascript: URI) or a crafted culture-derived title that the Calendar/MultiViewCalendar month template renders without URL sanitization or HTML attribute encoding. When another user (potentially a higher-privileged one) opens the calendar and interacts with the affected month cell, the injected script executes in their browser session, allowing theft or tampering of data accessible in that context. No public exploit code was identified at the time of analysis, and successful exploitation depends on the required victim interaction (UI:R).