Description

Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-11-06T17:17:11.640Z",
  "pubdate": "2026-11-06T17:17:11.640Z",
  "executiveSummary": "A Prototype Pollution vulnerability exists in @progress/kendo-vue-common, affecting Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0.\nThe vulnerability occurs due to improper sanitization of field paths processed by specific components, such as the Scheduler, allowing an attacker to inject properties into the prototype of built-in JavaScript objects.\nThis flaw enables a high-privileged attacker to alter the behavior of the application by modifying the global Object prototype.\nThe impact includes limited compromises to confidentiality, integrity, and availability, as the pollution can affect subsequent logic execution and data processing across the application environment.\nSuccessful exploitation requires the attacker to have sufficient privileges to control or influence the field paths processed by the affected Kendo UI components.",
  "technicalDetails": "The root cause of this vulnerability lies in the recursive merging or assignment logic within @progress/kendo-vue-common where object paths are processed without adequate validation. When the library handles deep object assignments based on user-provided or externally controlled paths, it fails to sanitize inputs against malicious keys such as '__proto__', 'constructor', or 'prototype'.\nIn the context of the Scheduler component, the library often traverses nested object structures to set data attributes or configuration properties. If an attacker supplies a crafted object path that utilizes 'constructor.prototype' or '__proto__', the underlying JavaScript engine resolves these keys to the base Object prototype.\nThe attack flow proceeds as follows: First, the attacker identifies a component, such as the Scheduler, that accepts configurable properties via client-side inputs. Second, the attacker crafts a malicious payload containing nested properties mapped to prototype-altering keys. Third, the application's internal utility function, responsible for deep property assignment, processes this path. Finally, the assignment operation modifies the prototype of all objects within the runtime environment.\nBecause JavaScript objects inherit from the global Object prototype, modifying this prototype allows the attacker to inject arbitrary properties or functions that are subsequently accessible by every object in the application. This can be used to override existing methods, inject unintended data, or alter the execution flow of logic that relies on object property checks.\nWhile the impact is described as 'limited,' the potential for cross-component interference is significant. By polluting the prototype, an attacker can influence how other components behave, bypass security checks that rely on property existence or state, or cause denial-of-service conditions if essential methods are overwritten.\nThe vulnerability affects versions 0.4.0 through 9.2.0 of @progress/kendo-vue-common. The exploitation requirement involves high-privilege access, meaning the attacker must already be in a position to manipulate component configuration or data bindings. This is typically observed in administrative dashboards or complex interfaces where end-user input is passed directly to component props without strict schema validation."
}