Progress Telerik Kendo UI for Vue Prototype Pollution Vulnerability Allowing Denial-of-Service or Command Injection

A prototype pollution vulnerability has been identified in Progress Telerik Kendo UI for Vue, affecting versions 2.4.0 prior to 6.0.1. This vulnerability allows an attacker to introduce or modify properties within the global prototype chain, potentially leading to denial-of-service conditions or command injection.

Impact

Exploitation of this vulnerability can cause denial-of-service conditions or allow for command injection.

Remediation

Users are advised to update to Kendo UI for Vue version 6.1.0 or later. The updated packages are available via npm. For more information, see the Kendo UI for Vue installation documentation.