Kendo UI EUVD-2026-102084

Exploitation requires the attacker to control data that is passed through an affected model's Model.accept method (e.g. a server response or record whose keys the application binds), with that payload containing unsafe object paths such as __proto__, constructor, or prototype. Limiting factors per the CVSS vector: the attacker needs some privilege level (PR:L) to supply model-accepted data and user interaction (UI:R) must occur, and real-world impact is gated on how the application uses the polluted objects - impact is amplified specifically in server-side JavaScript (Node) scenarios and may be negligible in applications that never rely on the affected prototype attributes. Not exploitable against versions 2026.3.1015 and later, where the fix is applied.

This is a moderate-severity prototype pollution flaw (CWE-1321) with a vendor-assigned CVSS 3.1 score of 5.4 (AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a real-but-conditional issue rather than a top-tier emergency: the network vector and low complexity ease reach, but exploitation requires some privilege level (PR:L - the attacker must be able to supply data that an affected model accepts) and user interaction (UI:R). The scope change (S:C) and only Low confidentiality/integrity impact with no availability impact reflect that pollution of Object.prototype can cross a trust boundary and influence downstream logic, but the concrete damage is entirely dependent on how the host application consumes the mutated objects. No EPSS score, CISA KEV listing, or public POC is present in the provided data, so there is no evidence of active or widespread exploitation - the only source is the Progress/Telerik vendor advisory. Prototype pollution is a well-understood and frequently weaponized bug class, which raises latent risk, but absent a public exploit or KEV entry this should be treated as a patch-in-normal-cycle item, prioritized higher for applications that pass Kendo models into server-side JavaScript (Node) contexts where prototype pollution can escalate to more serious impact.

An attacker who can influence data returned to and accepted by an affected Kendo UI model (for example, via a manipulated server response or a crafted record the application binds through Model.accept) includes a key such as __proto__ or constructor.prototype in the payload. Because the key is passed to kendo.setter without path guarding, the attacker mutates the Object prototype, altering application behavior to leak or tamper with data. No public exploit code is identified at time of analysis, and the attack requires the victim-side user interaction and privilege implied by the CVSS vector.