Skip to content
OpenAdvisories
Medium · 4.1 CVE-2026-106128 EUVD-2026-118372GHSA-m25x-x7gp-8wcj

Prototype Pollution in Progress Software Kendo UI for Vue

Published Nov 6, 2026 · Updated Nov 6, 2026 · Assigned by ProgressSoftware

Description

Prototype Pollution in @progress/kendo-vue-common in Progress Software Kendo UI for Vue versions 0.4.0 through 9.2.0 allows a high-privileged attacker who can control a field path processed by components such as the Scheduler to modify the prototype of built-in objects, resulting in a limited impact on confidentiality, integrity, and availability.

Affected products

VendorProductAffectedFixed
Progress Software Kendo UI for Vue 0.4.0 – < 10.0.0 10.0.0

References