CVE-2026-106160: Prototype Pollution via Model.accept and kendo.setter in Kendo UI for jQuery

Severity: medium (CVSS 5.4 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-10-15 · updated 2026-10-20
Weakness: CWE-1321

Description

In Progress® Kendo® UI for jQuery prior to 2026.3.1015, Model.accept passes server-response keys to kendo.setter without guarding against unsafe object paths containing __proto__, constructor, or prototype. An attacker who can supply data accepted by an affected model can modify object prototype attributes and influence application behavior, potentially compromising the confidentiality and integrity of application data. The impact depends on how the application uses the modified objects, including in server-side JavaScript scenarios. The earliest affected version has not been confirmed. This issue is fixed in version 2026.3.1015.

Affected products

Progress Software Kendo UI for jQuery: from 2023.1.117 before 2026.3.1015 — fixed in 2026.3.1015

How to fix

Upgrade to a fixed version: Progress Software Kendo UI for jQuery 2026.3.1015. Check the vendor advisory for mitigations.

References

https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-model-accept-prototype-pollution-cve-2026-106160

Get alerted when CVE-2026-106160 or the next vulnerability affects your stack