Cross-Site Scripting Vulnerability in Kendo UI for Vue by Progress Software
CVE-2026-106143

5.4MEDIUM

Key Information:

Vendor

Progress Software
Status
Kendo Ui For Vue
Vendor
CVE Published:
6 November 2026

What is CVE-2026-106143?

A Cross-Site Scripting vulnerability exists in the Editor component of Kendo UI for Vue, which allows low-privileged attackers to inject malicious JavaScript through unsafe URLs in the Insert Link or Insert Image dialog. When users interact with these links, the injected scripts execute in their browsers, potentially compromising sensitive information.

Affected Version(s)

Kendo UI for Vue 2.7.1 < 10.1.0

References

https://www.telerik.com/kendo-vue-ui/components/knowledge...
vendor-advisory

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Abhishek Nandkumar Bhaskar (Abhi-Hackz)
.