Description

Prototype Pollution in the Scheduler component (@progress/kendo-angular-scheduler and @progress/kendo-angular-common) in Progress Software Kendo UI for Angular versions prior to 25.1.0 allows a high-privileged attacker who can control a field path processed by the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.1",
  "pubDate": "2026-11-06T17:17:12.650Z",
  "pubdate": "2026-11-06T17:17:12.650Z",
  "executiveSummary": "A Prototype Pollution vulnerability has been identified within the Scheduler component of Progress Software Kendo UI for Angular, specifically affecting the @progress/kendo-angular-scheduler and @progress/kendo-angular-common packages.\nThe vulnerability occurs due to improper input sanitization when processing field paths, enabling a high-privileged attacker to inject malicious properties into the prototype of built-in JavaScript objects.\nSuccessful exploitation compromises the integrity of the application's runtime environment, potentially leading to unauthorized modification of object behaviors.\nThe risk is limited by the prerequisite requirement for the attacker to possess high privileges and the ability to influence the specific field path logic consumed by the Scheduler component.\nThis vulnerability affects all versions of the specified packages prior to the release of version 25.1.0.\nImpact includes a degradation of application confidentiality, integrity, and availability, as global object modification can alter the execution context and logic flow of the Angular application.",
  "technicalDetails": "The vulnerability resides within the internal property access and configuration logic of the Scheduler component in the @progress/kendo-angular-scheduler and @progress/kendo-angular-common libraries. The root cause is an insecure implementation of utility functions responsible for resolving or assigning nested properties based on dynamic input strings or object paths.\nWhen the Scheduler component parses configuration objects, it fails to sufficiently validate the user-controlled input paths. If an attacker can supply a specially crafted path string containing keys such as '__proto__', 'constructor', or 'prototype', the underlying assignment logic may inadvertently traverse and modify the prototype chain of global JavaScript objects (e.g., Object.prototype).\nThe attack flow begins when an attacker, possessing high-level application privileges, provides an input payload that the Scheduler component subsequently processes as a path reference. By injecting property keys that map to the internal prototype pointers of the JavaScript runtime, the attacker can overwrite existing properties or inject new ones into the base Object prototype.\nBecause these prototypes are inherited by nearly all objects within the application's execution context, the injected properties can influence subsequent data processing, logic gates, or security checks throughout the application. This effectively 'pollutes' the global object environment.\nThe exploitation requirement mandates that the attacker must have authorization to interface with the Scheduler configuration inputs. While the impact is labeled as limited, the potential for escalation exists if the application logic relies on properties that the attacker has successfully overridden via the prototype chain. This can lead to denial of service by corrupting system functionality, potential bypasses of client-side validation, or the unintended leakage of sensitive information if manipulated objects are logged or serialized.\nThis vulnerability is present in versions prior to 25.1.0 and does not appear to require network-level exposure beyond the application's interface surface, as the exploitation is driven by the internal handling of object schemas."
}