CVE-2026-106135: Cross-Site Scripting in Progress Software Kendo UI for Angular

Published Nov 6, 2026

Updated

Cross-Site Scripting (XSS) in the Chat component (@progress/kendo-angular-conversational-ui) in Progress Software Kendo UI for Angular versions prior to 25.3.0 allows a low-privileged attacker who can supply Chat messages to execute arbitrary JavaScript in another user's browser via an unsafe URL in an openUrl quick action, which runs when the user clicks the action.

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade @progress/kendo-angular-conversational-ui to a version that resolves this vulnerability.
Fixed in 25.3.0

Event History

Nov 6, 2026

CVE Published

via MITRE·04:47 PM

Data Sourced

via MITRE·04:47 PM

DescriptionSeverityWeakness

Data Sourced

via NVD·05:17 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Who is exposed to this issue?

Applications using the Kendo UI for Angular Chat component are exposed if they allow a low-privileged user to supply Chat messages that can include openUrl quick actions. Exploitation requires another user to click the unsafe URL action.

What does an attacker need to exploit it?

The attacker needs the ability to supply Chat messages and to include an unsafe URL in an openUrl quick action. They also need a target user to click that action in their browser.

Which versions should be remediated?

Kendo UI for Angular versions earlier than 25.3.0 are affected. Upgrade to version 25.3.0 or later.

CVE-2026-106135: Cross-Site Scripting in Progress Software Kendo UI for Angular

Remediation

Event History

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions should be remediated?

Company

Resources

Contact

Frequently Asked Questions

Who is exposed to this issue?

What does an attacker need to exploit it?

Which versions should be remediated?