Kendo UI EUVD-2026-102078

Exploitation requires that the attacker can modify a Validator validation message consumed from a data-msg-* attribute (e.g. a field whose contents are attacker-influenced and later surfaced as a validation message), and that a victim user then performs an action that triggers the Validator's validation routine. Limiting factors: the attacker needs some privilege/write access to the message content (reflected by PR:L - this is not a fully unauthenticated flaw), victim user interaction is mandatory (UI:R), and only applications using the Kendo UI for jQuery Validator with data-msg-* driven messages prior to version 2026.3.1015 are affected. Impact is confined to script execution in the victim's browser (confidentiality and integrity of data accessible to the app), with no availability impact.

This is a moderate-severity stored/DOM cross-site scripting issue (CWE-80) in Progress Kendo UI for jQuery's Validator, rated CVSS 5.4 by the vendor (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a real-but-not-urgent priority rather than a mass-exploitation threat. The vector requires low privileges (PR:L) - specifically the ability to modify a validation message/data-msg-* attribute - plus victim user interaction (UI:R, triggering validation), which meaningfully constrains exploitation to attackers who already have some write access to the message content. There is no CISA KEV listing and no EPSS score or public POC supplied in the intelligence, so exploitation status is 'no public exploit identified at time of analysis'; nothing here indicates active or widespread exploitation. The scope change (S:C) and limited C/I impact (C:L/I:L/A:N) correctly reflect that successful attacks run script in a victim's browser session rather than compromising the server directly. Net: a legitimate flaw worth patching on a normal cycle, but the privilege and user-interaction prerequisites make it far lower real-world risk than its network attack vector alone might suggest. Note: no EPSS probability was provided, so quantitative exploitation likelihood cannot be stated.

An attacker with the ability to control a validation message (for example via a stored field that feeds a data-msg-* attribute) injects HTML containing an event handler that was previously safely escaped in the page. When a legitimate user interacts with the affected form and triggers Validator validation, the Validator decodes and parses the message as live HTML, executing the attacker's JavaScript in that user's browser. No public exploit code was identified at the time of analysis.