Kendo UI EUVD-2026-102085

Exploitation requires (1) the attacker to be able to modify data that is bound to a Kendo UI Badge - specifically values passed to the Badge text method or supplied through text binding - which implies at least low-level write access to the bound data source (reflected in PR:L), and (2) a victim user to subsequently load a page where that Badge renders the attacker-controlled value (UI:R). It is limited to Kendo UI for jQuery versions from v2020.1.114 up to but not including 2026.3.1015; installations on 2026.3.1015 or later are not affected. Applications that never bind untrusted or user-modifiable data to a Badge, or that sanitize values before binding, are not realistically exploitable. There is no requirement for a non-default configuration beyond simply using the vulnerable Badge text rendering.

This is a moderate-severity stored/DOM cross-site scripting issue (CWE-80) with a vendor CVSS of 5.4 (CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N). The signals are internally consistent and point to a real but not urgent priority: the network vector and low complexity make exploitation technically easy, but two factors meaningfully constrain real-world risk - PR:L means the attacker must already be an authenticated/privileged-enough user to modify the data bound to a Badge, and UI:R means a victim must actually render that Badge. The scope change (S:C) correctly reflects that injected script executes in the victim's browser context rather than the component's own, which is why confidentiality and integrity are rated Low rather than None, and availability is None. No EPSS score, KEV listing, or SSVC decision data was supplied in the input, and there is no evidence of public exploit code - so this is 'no public exploit identified at time of analysis.' There is no conflict between the CVSS vector and the description: both describe a remote, interaction-dependent XSS requiring some level of data-write privilege. Overall this is a legitimate issue to patch on a normal cadence rather than an emergency; it is a textbook XSS with a meaningful privilege prerequisite, not a high-CVSS-but-illusory finding, but also not a wormable or unauthenticated bug.

An attacker with the ability to influence data bound to a Kendo UI Badge (for example a lower-privileged user whose profile field or record feeds a Badge's text) supplies a string containing an HTML event handler such as an onerror or onload attribute. Because the Badge text method renders the value as raw HTML without encoding, the payload executes JavaScript in the browser of any user who later views the page rendering that Badge, enabling session/data theft or actions in the victim's context. No public proof-of-concept was identified in the provided data.