Kendo UI CVE-2026-106158

Exploitation requires: (1) the attacker can control a resource's color value within the Kendo UI Scheduler - a data input that, depending on the hosting application, may require authenticated create/edit access to scheduler resources rather than being anonymously settable; (2) the application uses one of the affected Scheduler views (Day, Timeline, Month, or Agenda); and (3) required user interaction (CVSS UI:R) - a victim must open the affected view and interact with the maliciously crafted event for the injected handler to fire. Limiting factors that reduce realistic risk: high attack complexity (AC:H), mandatory victim interaction, and the practical need for some level of write access to resource data. Running version 2026.3.1015 or later eliminates the flaw.

This is a moderate-severity stored/DOM cross-site scripting issue (CWE-80) in Progress Kendo UI for jQuery, vendor-rated CVSS 4.7 with vector AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. Multiple real-world signals converge on LOW immediate priority: no public exploit identified at time of analysis, no EPSS score was provided in the input, and the vulnerability is NOT listed in CISA KEV - so there is no evidence of active exploitation. The CVSS vector itself tempers the network attack vector (AV:N) with high attack complexity (AC:H) and required user interaction (UI:R, the victim must interact with a crafted scheduler event), which materially lowers realistic exploitability. A tension worth flagging: the vendor assigns PR:N (unauthenticated), yet the description requires an attacker to 'control a resource color' value, which in most deployments is a privileged create/edit operation on scheduler resources rather than anonymous input - this suggests effective exploitation more often requires at least low-privilege authenticated access than the PR:N rating implies; verify against the specific application's resource-management permissions. The S:C (scope change) and C:L/I:L impacts are consistent with XSS executing in another user's authenticated browser session. Net: a genuine but low-urgency defense-in-depth fix, not an emergency; patch on a normal maintenance cycle unless the affected app exposes resource-color control to untrusted users.

An attacker with the ability to set a scheduler resource's color value (e.g., via a shared calendar, booking, or multi-tenant scheduling feature) injects a color string containing additional HTML attributes and an event handler. When a victim later opens the Day, Timeline, Month, or Agenda view and interacts with the affected event, the injected JavaScript executes in their browser session, potentially exposing data accessible to the application. No public exploit code has been identified at time of analysis.