Kendo UI for jQuery EUVD-2026-102076

Exploitation requires that the application bind attacker-controllable data into the Kendo UI for jQuery Menu component's dataSource fields, which the Menu then concatenates into HTML attributes without neutralization. The attacker must already hold low-level privileges sufficient to write those bound fields (PR:L), and a victim must actively interact with the rendered Menu for the injected event-handler attribute to fire (UI:R) - automatic/no-interaction triggering is not indicated. Risk is limited to deployments on Kendo UI for jQuery versions prior to v2026.3.1015 that surface user-controllable data through Menu bindings; applications that do not expose writable dataSource fields to lower-privileged users, or that apply their own output encoding, are not realistically exposed.

This is a moderate-severity, lower-priority stored/DOM cross-site scripting flaw (CWE-80) rather than a mass-exploitation threat. The vendor CVSS 3.1 vector (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N, base 5.4) tells a coherent story: exploitation is network-reachable and low-complexity, but it requires an attacker who already holds low-level privileges to control the dataSource fields bound into the Menu, AND it requires a victim to interact with the rendered Menu (UI:R). The scope change (S:C) and C:L/I:L reflect that injected JavaScript runs in another user's browser context, affecting data beyond the vulnerable component itself, but impact is only Low across confidentiality and integrity with no availability impact. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so the realistic signal is: not actively exploited and no public exploit identified at time of analysis. The combination of required prior privileges plus required user interaction materially limits real-world risk - this is a defense-in-depth output-encoding fix, not an urgent internet-facing emergency. No signals conflict; the main gap is the absence of EPSS/KEV/POC data, whose absence is expected for a newly disclosed vendor-reported issue and should not be read as low risk by itself.

An attacker with a low-privileged application account populates a data field (e.g., a Menu item label or attribute sourced from the bound dataSource) with a crafted value containing a JavaScript event-handler attribute. When a higher-privileged or different user later views and interacts with the Menu, the injected handler fires in that victim's browser, allowing theft of session-accessible data or actions in the victim's context. No public exploit code was identified in the provided data, and successful exploitation depends on victim interaction with the affected Menu.