Description

Prototype Pollution in the setter utility (@progress/kendo-react-common) in Progress Software KendoReact versions 3.5.0 through 16.0.0 allows a high-privileged attacker who can control a field path passed to the utility, directly or through components such as the Form, Scheduler, and Gantt, to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-11-06T17:17:11.497Z",
  "pubdate": "2026-11-06T17:17:11.497Z",
  "executiveSummary": "A prototype pollution vulnerability exists within the setter utility of the @progress/kendo-react-common package. This security flaw impacts multiple KendoReact components, including Form, Scheduler, and Gantt, by enabling the modification of built-in JavaScript object prototypes.\nThe vulnerability occurs when a high-privileged attacker gains control over a field path string processed by the vulnerable setter utility. By injecting malicious key sequences (e.g., __proto__ or constructor), an attacker can influence the behavior of objects throughout the application's runtime.\nSuccessful exploitation results in a compromise of application integrity, confidentiality, and availability. While the impact is characterized as limited, it provides a vector for secondary attacks such as cross-site scripting (XSS), denial of service, or logic manipulation. This vulnerability affects Progress Software KendoReact versions 3.5.0 through 16.0.0. The primary exploitation requirement is the attacker's ability to influence data passed to the setter utility, typically facilitated by high-privileged access to inputs or component configurations.",
  "technicalDetails": "The vulnerability resides in the internal setter utility function provided by @progress/kendo-react-common. This utility is responsible for dynamically updating deeply nested properties within JavaScript objects based on a string-based field path. The implementation fails to properly sanitize or validate the keys within the path, specifically failing to block access to sensitive prototype-related properties.\nThe root cause is a failure to implement a robust blocklist or allowlist for recursive object property assignment. When the utility traverses the object tree to assign values, it does not check for the presence of '__proto__', 'constructor', or 'prototype' keys. Consequently, these keys are treated as standard object properties during the assignment process.\nThe attack flow begins when an attacker provides a crafted input payload—often through a form field, component configuration, or URL parameter—that the application eventually passes to the setter utility. By specifying a path such as '__proto__.pollutedProperty', the attacker forces the utility to assign a value to the prototype of the global Object constructor.\nOnce the prototype of the global Object is modified, every object in the application context inherits the 'pollutedProperty'. This allows the attacker to alter the default behavior of objects, potentially overriding standard methods or injecting properties that influence subsequent code execution. Because this utility is used by core KendoReact components like Form, Scheduler, and Gantt, the attack surface is wide, as these components frequently use the utility to manage state and configuration updates.\nThe exploitation requires high-privileged access, as the utility must be invoked with controlled input, typically via administrative or configuration interfaces. The impact of the pollution is persistent within the client-side environment for the duration of the page session. Depending on the properties overridden, an attacker might bypass security checks, induce JavaScript exceptions resulting in a denial of service, or facilitate the execution of arbitrary scripts if the application relies on object properties for navigation, rendering, or security-sensitive logic."
}