Cross-Site Scripting Vulnerability in Kendo UI for Angular by Progress Software
CVE-2026-106135

5.4MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Angular
Vendor
CVE Published:
6 November 2026

What is CVE-2026-106135?

The Chat component in Kendo UI for Angular prior to version 25.3.0 is susceptible to Cross-Site Scripting (XSS). This vulnerability allows a low-privileged attacker to inject arbitrary JavaScript into another user's browser through crafted Chat messages containing unsafe URLs in openUrl quick actions. This execution occurs when the affected user interacts with the action, potentially compromising user data and session integrity.

Affected Version(s)

Kendo UI for Angular 0 < 25.3.0

References

https://www.telerik.com/kendo-angular-ui/components/knowl...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.