Description

Cross-Site Scripting (XSS) in the Menu component (@progress/kendo-react-layout) in Progress Software KendoReact versions 1.3.0 through 16.1.0 allows a low-privileged attacker who can influence the Menu item data to execute arbitrary JavaScript in the origin of the application via an unsafe URL in a Menu item, which runs when a user selects the item.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "5.4",
  "pubDate": "2026-11-06T17:17:11.783Z",
  "pubdate": "2026-11-06T17:17:11.783Z",
  "executiveSummary": "A Cross-Site Scripting (XSS) vulnerability exists within the Menu component of the @progress/kendo-react-layout package. This security flaw affects versions 1.3.0 through 16.1.0.\nThe vulnerability enables a low-privileged attacker, capable of influencing the data supplied to the Menu component, to execute arbitrary JavaScript code within the security context of the victim's browser.\nThis occurs when a user interacts with a maliciously crafted Menu item containing an unsafe URL. The successful exploitation of this flaw can lead to unauthorized actions, session hijacking, data exfiltration, or the defacement of the application's interface.\nThe risk is categorized as high, as it allows for the execution of client-side code on behalf of authenticated users, potentially compromising the integrity and confidentiality of the web application session.",
  "technicalDetails": "The root cause of the vulnerability is the improper neutralization of user-supplied data within the KendoReact Menu component. Specifically, the component fails to adequately sanitize URLs provided as input for Menu items before rendering them in the Document Object Model (DOM).\nIn the affected versions (1.3.0 through 16.1.0), the Menu component handles URL-based data attributes insecurely. When an attacker can influence the configuration or data source of a Menu item, they can inject malicious input—most notably 'javascript:' URIs.\nThe exploitation flow proceeds as follows: First, an attacker injects a payload into the application data that is subsequently consumed by the KendoReact Menu component. This payload is structured as an unsafe URI, such as 'javascript:alert(document.domain)'. Second, the Menu component renders this URI into the component's internal structure. Finally, when a legitimate user selects or interacts with the malicious Menu item, the browser interprets the 'javascript:' protocol and executes the embedded code within the origin of the host application.\nThis vulnerability is particularly dangerous because it does not require administrative privileges to initiate, provided the attacker has an avenue to influence the menu's data structure. Because the execution occurs within the victim's authenticated session, the malicious script inherits the victim's permissions and access rights.\nThe impact includes, but is not limited to, the exfiltration of sensitive cookies, tokens, or local storage data. Furthermore, the attacker could manipulate the DOM to present fraudulent login prompts or perform unauthorized state-changing operations on behalf of the user, effectively bypassing client-side security controls. The vulnerability remains effective as long as the component performs insufficient validation on the URI attributes associated with user-controlled input."
}