Kendo UI CVE-2026-106157

Exploitation requires that the target application binds the Kendo UI for jQuery PanelBar component to a data source in which item URL values are attacker-influenceable (e.g., URLs drawn from user input or untrusted records), on an affected version (2019.2.514 through versions before 2026.3.1015). The attacker must be able to inject a value that escapes the single-quoted href attribute, and a victim must then interact with that specific PanelBar item (UI:R) for the injected event handler to fire. Limiting factors: it does not affect applications whose PanelBar URLs are entirely static or server-controlled; it depends on the specific app wiring user data into item URLs (reflected in AC:H); it requires victim interaction; and it is fully remediated by upgrading to 2026.3.1015.

This is a genuine but moderate-priority issue, not a top-tier emergency. The vendor-supplied CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7) tells a coherent story that matches the description: a DOM/stored XSS in the Kendo UI for jQuery PanelBar that is network-reachable and needs no attacker privileges, but is gated by both high attack complexity (AC:H - the attacker must first find an application that renders attacker-controllable PanelBar item URLs) and required user interaction (UI:R - a victim must interact with the poisoned item). Impact is deliberately scoped as Low/Low confidentiality and integrity with the changed scope (S:C) reflecting that injected JavaScript executes in the victim's browser session rather than on the server. No EPSS score, no CISA KEV listing, and no public POC were provided, so by the precision rules this is 'no public exploit identified at time of analysis' - there is no signal of active or widespread exploitation. The signals are internally consistent (no conflict between CVSS and description), so the realistic verdict is a legitimate client-side XSS worth patching on a normal cadence, elevated only for applications that expose user-controlled URLs through PanelBar, and not a drop-everything issue absent exploitation evidence.

An application binds a Kendo UI PanelBar to a data source whose item URL values originate from user- or attacker-influenced data (e.g., a navigation menu built from database records). An attacker supplies a crafted URL that breaks out of the single-quoted href attribute to inject an event-handler attribute, and when a victim later interacts with that PanelBar item, the attacker's JavaScript runs in the victim's authenticated browser session. No public exploit code was identified at time of analysis.