Kendo UI EUVD-2026-102083

Exploitation requires an application built on Kendo UI for jQuery (versions 2022.3.1109 through those before 2026.3.1015) that uses the ToolBar widget's ButtonGroup and populates button URLs from attacker-influenceable data. The attacker must supply an otherwise-allowed HTTPS URL that contains whitespace plus one or more additional attributes (including an event handler), which survive sanitization because the URL is concatenated into an UNQUOTED href attribute. Limiting factors: a victim must actively interact with the affected button (UI:R), the attacker must be able to control a button URL (so the application must expose such an input path, often implying some application-level or stored-input foothold), and the payload must be crafted to break out of the unquoted attribute (AC:H). Impact is limited to data accessible to the application in the victim's browser (C:L/I:L, no availability impact).

This is a genuine but comparatively low-urgency issue. The provided CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N, base 4.7, Medium) tells a consistent story: a DOM/stored XSS in the Kendo UI for jQuery ToolBar ButtonGroup where an attacker-controlled button URL bypasses sanitization. AC:H reflects that the attacker must craft a URL with whitespace and extra attributes to break out of the unquoted href, and UI:R means a victim must interact with the button, so exploitation is neither trivial nor fully automatic. No EPSS score, no CISA KEV listing, and no public exploit were provided, so exploitation status is 'no public exploit identified at time of analysis' - there is no signal of active exploitation or weaponization. The one point of tension: CVSS marks PR:N (unauthenticated), but the description's precondition 'an attacker who can control a button URL' implies the attacker must be able to inject data that the application renders into a button, which in many deployments requires some application-level foothold or a stored-input path; treat the unauthenticated rating as the vuln-component default and verify against the specific application's data flow. Overall this is a real defect worth patching on a normal cycle, not an emergency - Medium severity, attacker-control precondition, high complexity, and required user interaction all cap real-world risk.

An attacker supplies a malicious but seemingly valid HTTPS URL (containing whitespace plus an injected event-handler attribute) into a field that an application renders as a Kendo UI ToolBar ButtonGroup button URL. Because the URL is concatenated into an unquoted href after sanitization, the extra attribute survives, and when a victim user interacts with the button in their browser the injected JavaScript executes in the application's context. No public exploit code was identified at time of analysis, but the technique is straightforward for an attacker who can influence button URLs.