Cross-Site Scripting in Kendo UI for Angular by Progress Software
CVE-2026-106141

5.4MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Angular
Vendor
CVE Published:
6 November 2026

What is CVE-2026-106141?

A Cross-Site Scripting vulnerability exists in the Editor component of Kendo UI for Angular versions prior to 25.3.0. This security flaw allows a low-privileged attacker to exploit it by injecting arbitrary JavaScript through links or images containing unsafe URLs. The malicious script runs in the context of another user's browser when they interact with the compromised content, potentially leading to unauthorized actions and data exposure. Users are advised to upgrade to the latest version to mitigate the risk associated with this vulnerability.

Affected Version(s)

Kendo UI for Angular 0 < 25.3.0

References

https://www.telerik.com/kendo-angular-ui/components/knowl...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.