Progress Telerik KendoReact Prototype Pollution Vulnerability Allowing Denial-of-Service or Command Injection

A vulnerability exists in Progress Telerik KendoReact versions 3.5.0 prior to 9.4.0, allowing attackers to introduce or modify properties within the global prototype chain. This manipulation can lead to denial-of-service conditions or command injection vulnerabilities.

Impact

Exploitation of this vulnerability can cause denial-of-service conditions or allow for command injection.

Remediation

Users are advised to update to Progress Telerik KendoReact version 9.4.0 or later. The updated packages are available via npm. For version 9.4.0 update instructions, refer to the KendoReact installation documentation.