What is GHSA-r2wf-fj2x-9c4c?

GHSA-r2wf-fj2x-9c4c is a security advisory published by GitHub Security Advisories with High severity. In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM...

Which CVE IDs does GHSA-r2wf-fj2x-9c4c cover?

GHSA-r2wf-fj2x-9c4c covers the following CVE IDs: CVE-2026-124690. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-r2wf-fj2x-9c4c?

GHSA-r2wf-fj2x-9c4c has a CVSS v3 base score of 7.1, published by GitHub Security Advisories.

GHSA-r2wf-fj2x-9c4cHighCVSS 7.1

In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM...

Vendor

GitHub Security Advisories

Published

November 11, 2026

Last Modified

November 11, 2026

🔗 CVE IDs covered (1)

CVE-2026-124690 →

📋 Description

In Progress Kendo UI for jQuery, sanitizeSvgContent() parses custom icon markup into a live DOM before filtering it. An attacker who can influence custom icon content can cause JavaScript to execute during icon creation, before an unsafe element is removed. The issue was reported in version 2026.3.1015; the first affected release has not been established. The issue is fixed in version 2026.4.1110.

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2026-124690
https://www.telerik.com/kendo-jquery-ui/documentation/knowledge-base/kb-security-kendo-svg-icon-sanitizer-xss-cve-2026-124690
https://github.com/advisories/GHSA-r2wf-fj2x-9c4c