What’s Vulnerable › Vulnerabilities
CVE-2024-11628: Prototype Pollution in Progress® Telerik® Kendo UI for Vue
- Severity: high (CVSS 7.2 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 0.7% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2025-02-12 · updated 2026-06-17
- Weakness: CWE-1321
Description
In Progress® Telerik® Kendo UI for Vue versions v2.4.0 through v6.0.1, an attacker can introduce or modify properties within the global prototype chain which can result in denial of service or command injection.
Affected products
- Progress Software Kendo UI for Vue: from 2.4.0 before 6.1.0 — fixed in 6.1.0
How to fix
Upgrade to a fixed version: Progress Software Kendo UI for Vue 6.1.0. Check the vendor advisory for mitigations.
References
Get alerted when CVE-2024-11628 or the next vulnerability affects your stack